CVE-2026-33989: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33989 is a Path Traversal vulnerability in the @mobilenext/mobile-mcp npm package, an MCP (Model Context Protocol) server for mobile development and automation. The flaw exists in the mobile_save_screenshot and mobile_start_screen_recording tools, where the saveTo and output parameters are passed directly to filesystem write operations without any path validation, allowing arbitrary file writes outside the intended workspace. All versions prior to 0.0.49 of @mobilenext/mobile-mcp for Node.js are affected. The vulnerability was published on March 25, 2026, and patched in version 0.0.49 released the same day. It carries a CVSS v3.1 base score of 8.1 (High) per the GitHub Advisory (Github Advisory, Security Advisory).

The root cause is the absence of path validation in src/server.ts when handling the saveTo parameter in mobile_save_screenshot (lines 584–592) and the output parameter in mobile_start_screen_recording (lines 597–620). The vulnerable code passes user-supplied paths directly to fs.writeFileSync(saveTo, screenshot) without sanitization, enabling directory traversal sequences such as ../../ or absolute paths like ~/.bashrc to resolve outside the workspace (Security Advisory). This is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (External Control of File Name or Path). Exploitation is delivered via crafted JSON-RPC messages sent to the MCP server's tools/call endpoint, requiring user interaction (e.g., a prompt injection attack tricking an AI agent into invoking the tool with a malicious path) (Github Advisory).

Successful exploitation allows an attacker to write arbitrary files to any location accessible by the MCP server process, including sensitive user files such as ~/.bashrc, ~/.ssh/authorized_keys, or application configuration files. Overwriting shell initialization files or SSH authorized keys can lead to persistent code execution or unauthorized remote access, effectively escalating from arbitrary file write to full code execution. Confidentiality impact is rated None (no direct data exfiltration), but integrity and availability are rated High, as critical system files can be corrupted or replaced (Security Advisory, Github Advisory).

A functional proof-of-concept Python exploit is publicly available in the GitHub security advisory, demonstrating the full attack chain including MCP session initialization and path traversal payload delivery via JSON-RPC (Security Advisory). The EPSS score is approximately 0.018% (5th percentile), indicating low current exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported as of the time of disclosure. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction — specifically, an AI agent or user must be tricked (e.g., via prompt injection from a malicious website or document) into invoking the vulnerable tool with an attacker-controlled path (Github Advisory).

1. Setup: Ensure Node.js and npx are available. The attacker prepares a Python exploit script that communicates with the @mobilenext/mobile-mcp server via JSON-RPC over stdin/stdout.
2. Start the MCP server: Launch the vulnerable server using npx -y @mobilenext/mobile-mcp@<0.0.49, either directly or by targeting an already-running instance.
3. Initialize MCP session: Send a JSON-RPC initialize request with protocol version 2024-11-05 and follow up with a notifications/initialized notification to complete the handshake.
4. Enumerate devices: Call mobile_list_available_devices via tools/call to obtain a valid device identifier required by the screenshot tool.
5. Deliver path traversal payload: Send a tools/call JSON-RPC request targeting mobile_save_screenshot with the saveTo parameter set to a traversal path (e.g., ../../exploit.png, ~/.ssh/authorized_keys, or ~/.bashrc):

{
  "jsonrpc": "2.0",
  "id": 100,
  "method": "tools/call",
  "params": {
    "name": "mobile_save_screenshot",
    "arguments": {"device": "<device_id>", "saveTo": "../../.bashrc"}
  }
}

6. Verify file write: Check whether the target file was created or overwritten at the resolved path outside the workspace. The server responds with Screenshot saved to: <path> on success.
7. Achieve persistence or code execution: By overwriting ~/.bashrc or ~/.ssh/authorized_keys with attacker-controlled content, the attacker can establish persistent shell access or inject commands executed on next login (Security Advisory).

• File System: Unexpected files written outside the MCP server's working directory or temp directory, particularly in home directories (e.g., ~/exploit.png, ~/.poc_dotfile); modifications to ~/.bashrc, ~/.ssh/authorized_keys, or other shell/config files with timestamps matching MCP server activity.
• Logs: MCP server logs or stdout showing Screenshot saved to: responses with paths containing ../, absolute home directory paths, or paths outside the workspace; JSON-RPC tools/call requests to mobile_save_screenshot or mobile_start_screen_recording with suspicious saveTo or output parameter values.
• Process: The mobile-mcp Node.js process writing files to unexpected filesystem locations; npx spawning the MCP server process followed by unusual file creation events in user home directories.
• Network: If the MCP server is exposed over a network interface, inbound JSON-RPC requests to tools/call endpoints with traversal sequences (../, ~, absolute paths) in screenshot or recording parameters (Security Advisory).

Upgrade @mobilenext/mobile-mcp to version 0.0.49 or later, which introduces validateOutputPath() and validateFileExtension() functions in src/utils.ts that restrict write destinations to the current working directory and the system temp directory, and enforce allowed file extensions (.png/.jpg/.jpeg for screenshots, .mp4 for recordings) (Patch Commit, Release 0.0.49). As a workaround prior to patching, restrict the filesystem permissions of the user account running the MCP server to limit write access to only the intended workspace and temp directories. Additionally, avoid exposing the MCP server to untrusted input sources, and implement prompt injection mitigations in any AI agent pipelines that invoke this server.

The vulnerability was reported by security researcher AbhiTheModder and credited in the official release notes for version 0.0.49 (Release 0.0.49). Community discussion was observed on Mastodon and Bluesky shortly after disclosure, with aggregators such as VulDB and CVEFeed picking up the advisory. The vulnerability attracted attention in the MCP security community given the broader concern about prompt injection attacks enabling arbitrary file writes through AI agent tool invocations, with at least one blog post analyzing the path traversal pattern in MCP servers (Security Advisory).