Read the docs
TI-2026-13061 Aliases CVE-2026-15522GHSA-9cqv-qvmj-xrc4

tugcantopaloglu godot-mcp run_project index.js validatePath path traversal

Priority MEDIUM 55CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A security flaw has been discovered in tugcantopaloglu godot-mcp 2.0.0. Affected by this vulnerability is the function validatePath of the file build/index.js of the component run_project. The manipulation of the argument projectPath results in path traversal. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. Upgrading to version 3.0.0 addresses this issue. The patch is identified as eb63add552aa4bd9205395cf91b40654654a3cf2. It is suggested to upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed godot-mcp (tugcantopaloglu): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tugcantopaloglugodot-mcp2.0.03.0.0Patch availableCNA
  • godot-mcp Vendortugcantopaloglu Affected 2.0.0 Fixed in 3.0.0 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:tugcantopaloglu:godot-mcp:*:*:*:*:*:*:*:*——tugcantopaloglu
  • cpe:2.3:a:tugcantopaloglu:godot-mcp:*:*:*:*:*:*:*:* Versions — — ·tugcantopaloglu

Remediation

  • Fix · CNA godot-mcp (tugcantopaloglu) Fixed in 3.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15522
  2. 2026-10-03 Alias added: GHSA-9cqv-qvmj-xrc4

References

Exploit 1

Patch 2

Other 1

  • TI-2026-47175 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field CVSS 4.0CRITICAL 9.3
  • TI-2026-47177 OpenClaw Dashboard Stored XSS via lastMessage Session Field CVSS 4.0HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences