Path Traversal Vulnerability in Astralisone Rive-MCP-Server-Core
CVE-2026-19288

4.8MEDIUM

Key Information:

Vendor

Astralisone

Status
Rive-mcp-server-core
Vendor
CVE Published:
8 August 2026

What is CVE-2026-19288?

A path traversal vulnerability has been identified in the Astralisone Rive-MCP-Server-Core, specifically within the importRiveFile Flow component. Manipulating the libraryId argument in the file packages/mcp-server/src/tools/importRiveFile.ts allows for unauthorized file access on local systems. This issue arises from insufficient validation and impacts versions up to db1d0cc4cd52589116360428b7504fd0ca748b3e. Although the project has been notified of this security risk, there has been no response regarding remediation measures.

Affected Version(s)

rive-mcp-server-core db1d0cc4cd52589116360428b7504fd0ca748b3e

References

https://vuldb.com/vuln/387027
vdb-entrytechnical-description
https://vuldb.com/vuln/387027/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-19288
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

gongyanyu03 (VulDB User)
VulDB CNA Team
.