Executive brief
The donchelo processing-claude-mcp-bridge is a tool that allows users to create and manage Processing sketches using natural language through the Claude AI platform. A security flaw in this bridge allows an attacker to bypass directory restrictions and write files to unauthorized locations on the host computer. This could lead to the creation of malicious files or the overwriting of sensitive data, potentially compromising the host system's integrity and security.
Technical details
A path traversal vulnerability (CWE-22) exists in the 'create_sketch' and 'update_sketch' tools within processing_server.py. The application fails to sanitize the 'sketch_name' argument, which is directly concatenated into filesystem paths using os.path.join without validation or canonicalization. A remote attacker can provide crafted input containing traversal sequences (e.g., ..\\..) to escape the intended PROCESSING_SKETCH_DIR and perform arbitrary file creation or overwrites on the host system. As of the report date, the project follows a rolling release model and has not yet released a fix for this issue.
Affected products
- donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd
Timeline
- 2026-04-10: disclosed: Issue reported to the project maintainer via GitHub.
- 2026-04-27: advisory: Vulnerability published by VulDB.