CVE-2026-7149 Details
Description
A vulnerability has been found in dexhunter kaggle-mcp up to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. This vulnerability affects the function prepare_kaggle_dataset of the file src/kaggle_mcp/server.py. The manipulation of the argument competition_id leads to path traversal. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in the dexhunter kaggle-mcp project, specifically in version 0.1.0 prior to the commit 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d. The issue arises in the prepare_kaggle_dataset function within src/kaggle_mcp/server.py. The vulnerability allows for manipulation of the competition_id argument, leading to unauthorized directory traversal. This issue can be exploited remotely, and a public exploit is available.
It is recommended to validate the competition_id against a strict regex pattern for Kaggle slugs, ensure that the final dataset path does not escape the designated cache root, and run the server with a low-privilege account in a sandboxed environment.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dexhunter/kaggle-mcp/ | [email protected] | Source CodeVendor |
| https://github.com/dexhunter/kaggle-mcp/issues/1 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/submit/802052 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/vuln/359748 | [email protected] | AdvisoryExploitTechnical Description |
| https://vuldb.com/vuln/359748/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dexhunter kaggle-mcp | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |