Junglewise Threat Intelligence

CVE-2026-15522: tugcantopaloglu godot-mcp path traversal in run_project

CVE-2026-15522 · Severity: medium · CVSS 5.3 · Published 2026-07-13

Executive brief

A security vulnerability exists in godot-mcp, a tool used to provide AI-driven control over the Godot game engine. An attacker with local access to the system can trick the tool into modifying arbitrary Godot projects on the machine. This allows the attacker to inject malicious scripts into those projects, which could lead to unauthorized code execution or persistent control over the victim's game development environment.

Technical details

A path traversal vulnerability exists in the `validatePath` function within `build/index.js` of the `run_project` component in godot-mcp 2.0.0. The validation logic only checks for literal '..' substrings, failing to restrict the `projectPath` argument to trusted directories or prevent absolute paths. A local attacker can provide a path to any writable directory containing a `project.godot` file. The application then invokes `injectInteractionServer`, which copies a script containing a TCP runtime-control channel and GDScript eval primitives into the target directory and modifies the project configuration to load it automatically. This results in persistent code injection into the target Godot project. The issue is addressed in version 3.0.0 by implementing an opt-in `GODOT_MCP_ALLOWED_DIRS` allowlist.

Affected products

  • tugcantopaloglu godot-mcp 2.0.0

Timeline

  • 2026-07-12: disclosed: Issue reported on GitHub
  • 2026-07-12: patched: Fix committed in eb63add552aa4bd9205395cf91b40654654a3cf2
  • 2026-07-13: advisory: CVE-2026-15522 published

References