https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:28:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-278142 EUVD-2026-278142 https://cve.radiocsirt.org/vuln/euvd-2026-278142 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33989 <p>Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.</p> <p>Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33989 https://cve.radiocsirt.org/vuln/ghsa-3p2m-h2v6-g9mx <p><strong>Affected:</strong> npm: @mobilenext/mobile-mcp</p> <p>### Summary The `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace.</p> <p>### Details **File:** `src/server.ts` (lines 584-592)</p> <p>```typescript tool( &#34;mobile_save_screenshot&#34;, &#34;Save Screenshot&#34;, &#34;Save a screenshot of the mobile device to a file&#34;, { device: z.string().describe(&#34;The device identifier...&#34;), saveTo: z.string().describe(&#34;The path to save the screenshot to&#34;), }, { destructiveHint: true }, async ({ device, saveTo }) =&gt; { const robot = getRobotFromDevice(device); const screenshot = await robot.getScreenshot(); fs.writeFileSync(saveTo, screenshot); // ← VULNERABLE: No path validation return `Screenshot saved to: ${saveTo}`; }, ); ```</p> <p>### Root Cause</p> <p>The `saveTo` parameter is passed directly to `fs.writeFileSync()` without any validation. The codebase has validation functions for other parameters (`validatePackageName`, `validateLocale` in `src/utils.ts`) but **no path validation function exists**.</p> <p>### Additional Affected Tool</p> <p>**File:** `src/server.ts` (lines 597-620)</p> <p>The `mobile_start_screen_recording` tool has the same vulnerability in its `output` parameter.</p> <p>### PoC ```py #!/usr/bin/env python3</p> <p>import json import os import su…</p> <p><strong>Affected:</strong> npm: @mobilenext/mobile-mcp</p> <p>### Summary The `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace.</p> <p>### Details **File:** `src/server.ts` (lines 584-592)</p> <p>```typescript tool( &#34;mobile_save_screenshot&#34;, &#34;Save Screenshot&#34;, &#34;Save a screenshot of the mobile device to a file&#34;, { device: z.string().describe(&#34;The device identifier...&#34;), saveTo: z.string().describe(&#34;The path to save the screenshot to&#34;), }, { destructiveHint: true }, async ({ device, saveTo }) =&gt; { const robot = getRobotFromDevice(device); const screenshot = await robot.getScreenshot(); fs.writeFileSync(saveTo, screenshot); // ← VULNERABLE: No path validation return `Screenshot saved to: ${saveTo}`; }, ); ```</p> <p>### Root Cause</p> <p>The `saveTo` parameter is passed directly to `fs.writeFileSync()` without any validation. The codebase has validation functions for other parameters (`validatePackageName`, `validateLocale` in `src/utils.ts`) but **no path validation function exists**.</p> <p>### Additional Affected Tool</p> <p>**File:** `src/server.ts` (lines 597-620)</p> <p>The `mobile_start_screen_recording` tool has the same vulnerability in its `output` parameter.</p> <p>### PoC ```py #!/usr/bin/env python3</p> <p>import json import os import su…</p> https://cve.radiocsirt.org/vuln/ghsa-3p2m-h2v6-g9mx