CVE-2026-15749
Last modified
CVE-2026-15749 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
A security flaw has been discovered in mastergo-design mastergo-magic-mcp up to 0.2.0. This issue affects the function execute of the file src/tools/get-c2d.ts of the component mcp__C2d. Performing a manipulation of the argument filePath results in path traversal. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| mastergo-design | mastergo-magic-mcp | 0.1; 0.2.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-15749?
How severe is CVE-2026-15749?
How do I fix CVE-2026-15749?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-15737AWS Bedrock AgentCore Python SDK is an open-source Python li…5.7
- CVE-2026-15738Incorrect behavior order in the Gateway API listener-rule ge…8.5
- CVE-2026-15739The Rich Showcase for Google Reviews plugin for WordPress is…6.4
- CVE-2026-1574The MyQtip – easy qTip2 plugin for WordPress is vulnerable t…6.4
- CVE-2026-15746Strands Agents is an open-source Python SDK for building and…6.9
- CVE-2026-15747Mojolicious versions from 4.59 before 9.48 for Perl expose a…9.1
- CVE-2026-1575The Schema Shortcode plugin for WordPress is vulnerable to S…6.4
- CVE-2026-15750A weakness has been identified in mastergo-design mastergo-m…6.3
- CVE-2026-15751A security vulnerability has been detected in mastergo-desig…5.3
- CVE-2026-15752A vulnerability was found in zhinianboke xianyu-auto-reply u…7.3
- CVE-2026-15753A vulnerability was determined in zhinianboke xianyu-auto-re…5.4
- CVE-2026-15755The Open User Map – Interactive Leaflet Maps plugin for Word…6.4
Are you affected by CVE-2026-15749?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST