Vulnerability · Published Aug 9, 2026 · Assigned by VulDB

CVE-2026-19328aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal

Medium 5.3

In plain English

A medium-severity path traversal in skill-ninja-mcp-server from aktsmm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.2%top 93.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed locally. Upgrading to version 0.1.1 is recommended to address this issue. The identifier of the patch is 855b46739e0f6e8388f17f9d0066ac4298a3965d. Upgrading the affected component is recommended.

Affected products (as reported)

Vendor	Product	Versions
aktsmm	skill-ninja-mcp-server	0.1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-387162 | aktsmm skill-ninja-mcp-server installer.ts uninstallSkill path traversal vdb-entry, technical-description
VDB-387162 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-19328 | CVE Analysis and Report third-party-advisory
Submit #865245 | aktsmm skill-ninja-mcp-server unknown Path Traversal third-party-advisory
https://github.com/aktsmm/skill-ninja-mcp-server/issues/2 issue-tracking
https://github.com/aktsmm/skill-ninja-mcp-server/commit/855b46739e0f6e8388f17f9d0066ac4298a3965d patch
https://github.com/aktsmm/skill-ninja-mcp-server/releases/tag/v0.1.1 patch
https://github.com/aktsmm/skill-ninja-mcp-server/ product