MonomythDevelopment la-forge-mcp screenshot_element Tool index.ts screenshotElement path traversal
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A security vulnerability has been detected in MonomythDevelopment la-forge-mcp 1.0.0. This issue affects the function screenshotElement of the file src/index.ts of the component screenshot_element Tool. Such manipulation of the argument output_name leads to path traversal. The attack can be executed remotely. Upgrading to version 1.1.1 is capable of addressing this issue. The name of the patch is 1102172c9adec4a619e241efd6bfb74f5b1f4332. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MonomythDevelopment | la-forge-mcp | 1.0.0 | 1.1.1 | Patch available | CNA |
- la-forge-mcp VendorMonomythDevelopment Affected 1.0.0 Fixed in 1.1.1 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:monomythdevelopment:la-forge-mcp:*:*:*:*:*:*:*:* | — | — | MonomythDevelopment |
- cpe:2.3:a:monomythdevelopment:la-forge-mcp:*:*:*:*:*:*:*:* Versions — — ·MonomythDevelopment
Remediation
- Fix · CNA la-forge-mcp (MonomythDevelopment) Fixed in 1.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19038
- 2026-10-03 Alias added: GHSA-h7vv-3j7j-4c9x
References
Patch 2
Sources
- CVE-2026-19038 · CVE Program
- CVE-2026-19038 · NVD
- FIRST EPSS
- GHSA-h7vv-3j7j-4c9x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences