CVE-2026-19338 automateyournetwork CVE debrief

Who should care

Users of MCPyATS up to version 0.1.4, operators, and security teams should review and verify their system configurations. They should also monitor for vendor remediation or patches and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

A path traversal vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4, specifically in the processGenerateRequest function of the mcp_servers/mermaid/index.ts file. The manipulation of the argument folder/name leads to path traversal. This vulnerability allows attackers to traverse the file system, potentially leading to unauthorized access or data breaches. Users of MCPyATS up to version 0.1.4 should review and verify their system configurations, monitor for vendor remediation or patches, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Defensive priority

Low-priority defensive review recommended due to limited details and low CVSS score.

Recommended defensive actions

• Review CVE details and affected product information
• Verify system inventory for MCPyATS up to 0.1.4
• Monitor for vendor remediation or patches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this CVE is limited. The vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcp_servers/mermaid/index.ts of the component generate_mermaid_markdown. The manipulation of the argument folder/name leads to path traversal. Defenders should verify their system configurations and monitor for vendor remediation or patches. Additional verification is recommended through primary official records and vendor remediation status.

Official resources