CVE-2026-19368: A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the fil
lowvulnerabilityLLM-Specific
security
Summary
A path traversal vulnerability (CWE-22, a flaw where an attacker can access files outside a restricted directory) was found in PV-Bhat gemsuite-mcp version 1.0.0, specifically in a file handling component that processes file_path arguments. An attacker with local access to the system could exploit this to access unauthorized files, though the project developers have not yet responded to the initial report.
Vulnerability Details
CVSS Score
3.3(low)
EPSS (30-day exploit probability)
EPSS: 0.0%
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
local
Attack Complexity
low
Privileges Required
low
User Interaction
none
Disclosure Date
August 9, 2026
Classification
Attack Type
Other
Attack SophisticationTrivial
Impact (CIA+S)
confidentiality
AI Component TargetedAPI
Affected Vendors
Google
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-19368
First tracked: August 9, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 72%