A path traversal flaw exists in the create_sketch Tool of processing_server.py. The flaw occurs when the sketch_name argument is manipulated, allowing an attacker to reference arbitrary file paths. This weakness, identified as CWE‑22, enables malicious users to read or potentially modify files beyond the intended sketch directory, and the description notes that remote exploitation of the attack is possible, which can lead to remote code execution if the attacker can write executable files or modify configuration files.

The vulnerability affects donchelo's processing‑claude‑mcp‑bridge component. Affected versions include any release up to the commit e017b20a4b592a45531a6392f494007f04e661bd. The project uses a rolling release model, so version details for newer releases are not provided. The flaw resides in the processing_server.py module of the create_sketch Tool, which is part of the public repository at https://github.com/donchelo/processing-claude-mcp-bridge.

The CVSS score of 6.9 indicates a moderate severity. EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. The description states that the exploit has been made available to the public and that remote exploitation is possible, so the risk of attack is significant, especially if the create_sketch endpoint is exposed to untrusted users.