CyberRota Analysis
AI-GeneratedA command injection vulnerability exists in the generateChart function of the generateAssets Tool in slidev-builder-mcp version 2.1.0, allowing local users to manipulate the outputDir argument. This flaw could lead to unauthorized command execution on affected systems. Developers and system administrators using this tool should prioritize remediation, especially in environments where local access is possible.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A security flaw has been discovered in adolfosalasgomez3011 slidev-builder-mcp 2.1.0. This affects the function generateChart of the file src/tools/generateAssets.ts of the component generateAssets Tool. Performing a manipulation of the argument outputDir results in command injection. The attack is only possible with local access. The project was informed of the problem early through an issue report but has not responded yet.