CVE-2026-19288Disclosure

LOWCVSS 1.9 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to path traversal. The attack needs to be performed locally. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

CyberSignal | Cybersecurity News@XQOPTRX46d
Disclosure
🤖 Another MCP implementation gets a path-traversal CVE CVE-2026-19288 affects rive-mcp-server-core. The vulnerability exists in its file-import functionality and can allow path traversal when a crafted identifier is processed. 📅 Published: August 8 🔎 Source: CVE / Vulners. #MCP #AISecurity #PathTraversal #CVE #CyberSecurity
Post summary
The tweet announces CVE-2026-19288, a path‑traversal vulnerability in rive-mcp-server-core’s file‑import routine, but offers no PoC, exploit tools, or patch information.
0000051
34 followersView on X

Explore more

Back to dashboard