Executive brief
kicad-mcp is a tool that allows AI agents and other software to interact with KiCad electronic design projects. A security flaw exists where the software fails to use its built-in safety checks when opening files or directories. A local attacker or a malicious AI prompt could exploit this to scan the computer's filesystem, confirm the existence of private files, and list the contents of sensitive directories that should be off-limits.
Technical details
A protection mechanism failure (CWE-693) exists in kicad-mcp through version 3.3.1. While the project includes a 'PathValidator' utility designed to prevent path traversal and restrict file operations to safe directories, this validator is not integrated into the 15 tool handlers located in 'kicad_mcp/tools/'. These handlers pass user-supplied 'project_path' and 'schematic_path' arguments directly to file system functions like 'os.path.exists', 'os.listdir', and 'open'. An attacker can use these tools as primitives to perform directory enumeration (e.g., via 'get_project_structure'), verify the existence of arbitrary files, and potentially leak small amounts of data through parse error messages. The vulnerability is reachable via any MCP client or through prompt injection against an agent using this MCP server.
Affected products
- lamaalrajih kicad-mcp up to 3.3.1
Timeline
- 2026-05-28: disclosed: Issue reported to the maintainer via GitHub issue #57
- 2026-07-13: advisory: CVE published by VulDB/NVD