CVE-2026-19288 Details
Description
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to path traversal. The attack needs to be performed locally. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in Astralisone Rive-MCP-Server-Core versions prior to db1d0cc4cd52589116360428b7504fd0ca748b3e. The issue arises in the 'importRiveFile' flow within the file 'packages/mcp-server/src/tools/importRiveFile.ts'. The vulnerability allows for manipulation of the 'libraryId' argument, leading to unauthorized file writes outside the intended directory. This issue can be exploited locally by overwriting arbitrary '.library.json'-suffixed files, depending on the process's write permissions.
To address this vulnerability, restrict the 'libraryId' parameter to safe identifier formats. Implement checks to reject traversal sequences, path separators, absolute paths, and drive-prefixed paths. After joining the path, verify that it remains within the confines of the 'manifestsPath' before performing any write operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 8, 2026CISA-ADP
Assessed Aug 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/astralisone/rive-mcp-server-core/issues/2 | CISA-ADP | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://github.com/astralisone/rive-mcp-server-core/ | [email protected] | ProductSource CodeVendor |
| https://github.com/astralisone/rive-mcp-server-core/issues/2 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-19288 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/865239 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/387027 | [email protected] | BundlePermission Required |
| https://vuldb.com/vuln/387027/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| astralisone rive-mcp-server-core | <= db1d0cc4cd52589116360428b7504fd0ca748b3e |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | CISA-ADP |
| Aug 8, 2026 | New CVE Received | [email protected] |