A path traversal vulnerability exists in the fs.promises.readFile call within src/server/callback-server.ts. The flaw allows an attacker to specify an arbitrary file path and read contents from the filesystem. The attack is limited to local execution, meaning the attacker must have local access to the machine running the service. The primary impact is the inadvertent disclosure of confidential or configuration data, which could facilitate further exploits.

The vulnerability affects the HelloGGX shadcn-vue‑mcp application in all releases up to and including commit e170e277b94235cde627803277fc8c41103a4d38. Because the project uses a rolling release model, no specific version numbers are listed, but all instances running the unpatched code are susceptible.

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires local access or the ability to influence file path arguments to the callback server; no remote code execution vector is disclosed. The risk is moderate but constrained to environments where the application runs with adequate user privileges.