CVE-2026-19281Disclosure

LOWCVSS 1.9 · LOW

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-74CWE-77

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification1 categories

Disclosure

3100.0%

Referenced assets2 URLs

By indicator

Full discourse3 posts

CVE@CVEnew46d
Disclosure
CVE-2026-19281 A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts … https://www.cve.org/CVERecord?id=CVE-2026-19281
Post summary
A new vulnerability, CVE-2026-19281, has been identified in slidev-builder-mcp 2.1.0, impacting the generateChart function in src/tools/generateAssets.ts, but no PoC, exploit, patch, or detailed technical information is provided.
000111.3K
57.9K followersView on X
Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-19281 A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts … https://www.cve.org/CVERecord?id=CVE-2026-19281 ----- Traducción: CVE-2026-19281 Se … http://infoflow.cloud`
Post summary
A new CVE (CVE-2026-19281) affecting the generateChart function in slidev-builder-mcp 2.1.0 is disclosed with a reference to the CVE record, but no PoC, exploit tool, exploitation reports, patches, or false‑positive claims are provided.
0000038
98 followersView on X
CyberSignal | Cybersecurity News@XQOPTRX46d
Disclosure
🤖 Slidev Builder MCP hit by command injection CVE-2026-19281 affects slidev-builder-mcp 2.1.0. The flaw is in its asset-generation functionality, where manipulation of an output directory can result in command injection. Local access is required. 🔎 Source: Rapid7 / MITRE CVE #MCP #AISecurity #CVE #CyberSecurity #AppSec
Post summary
CVE-2026-19281 is a local command injection flaw in slidev‑builder‑mcp 2.1.0’s asset‑generation feature, disclosed by Rapid7 / MITRE.
0000078
34 followersView on X

Explore more

Back to dashboard