CVE-2026-19281

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19281", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-07T15:32:57.573Z", "datePublished": "2026-08-08T11:30:08.959Z", "dateUpdated": "2026-08-11T01:27:46.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-08T11:30:08.959Z"}, "title": "adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "adolfosalasgomez3011", "product": "slidev-builder-mcp", "versions": [{"version": "2.1.0", "status": "affected"}], "cpes": ["cpe:2.3:a:adolfosalasgomez3011:slidev-builder-mcp:*:*:*:*:*:*:*:*"], "modules": ["generateAssets Tool"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-07T17:38:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gongyanyu02 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/387022", "name": "VDB-387022 | adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387022/cti", "name": "VDB-387022 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19281", "name": "CVE-2026-19281 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865225", "name": "Submit #865225 | adolfosalasgomez3011 slidev-builder-mcp 2.1.0 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"references": [{"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T01:27:23.068884Z", "id": "CVE-2026-19281", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:27:46.298Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19281", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-08-07T15:32:57.573Z", "datePublished": "2026-08-08T11:30:08.959Z", "dateUpdated": "2026-08-11T01:27:46.298Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-08-08T11:30:08.959Z"}, "title": "adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "adolfosalasgomez3011", "product": "slidev-builder-mcp", "versions": [{"version": "2.1.0", "status": "affected"}], "cpes": ["cpe:2.3:a:adolfosalasgomez3011:slidev-builder-mcp:*:*:*:*:*:*:*:*"], "modules": ["generateAssets Tool"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4.3, "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-08-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-08-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-08-07T17:38:03.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "gongyanyu02 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/387022", "name": "VDB-387022 | adolfosalasgomez3011 slidev-builder-mcp generateAssets Tool generateAssets.ts generateChart command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/387022/cti", "name": "VDB-387022 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-19281", "name": "CVE-2026-19281 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/865225", "name": "Submit #865225 | adolfosalasgomez3011 slidev-builder-mcp 2.1.0 Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202608"]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-19281", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T01:27:23.068884Z"}}}], "references": [{"url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T01:27:40.290Z"}}]}}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:adolfosalasgomez3011:slidev-builder-mcp:*:*:*:*:*:*:*:*"], "modules": ["generateAssets Tool"], "product": "slidev-builder-mcp", "vendor": "adolfosalasgomez3011", "versions": [{"status": "affected", "version": "2.1.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en adolfosalasgomez3011 slidev-builder-mcp 2.1.0. Esto afecta a la funci\u00f3n generateChart del archivo src/tools/generateAssets.ts del componente generateAssets Tool. Realizar una manipulaci\u00f3n del argumento outputDir resulta en inyecci\u00f3n de comandos. El ataque solo es posible con acceso local. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "id": "CVE-2026-19281", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19281", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T01:27:23.068884Z", "version": "2.0.3"}}]}, "published": "2026-08-08T12:16:46.057", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/"}, {"source": "cna@vuldb.com", "url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-19281"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/865225"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387022"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/387022/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/adolfosalasgomez3011/slidev-builder-mcp/issues/1"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-77"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.1.0"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "slidev-builder-mcp", "source": "cna", "vendor": "adolfosalasgomez3011"}, "product": "slidev-builder-mcp", "vendor": "adolfosalasgomez3011"}], "created": "2026-08-08T12:30:03.638787+00:00", "updated": "2026-08-08T14:30:06.380323+00:00", "vendors": ["adolfosalasgomez3011", "adolfosalasgomez3011$PRODUCT$slidev-builder-mcp"]}