Executive brief
Slideshot is a CLI tool and MCP server that converts HTML slides to image and PDF formats. A path traversal vulnerability in the render_slides function allows attackers to read arbitrary files on the server system by specifying absolute file paths, potentially exposing sensitive information like system configuration files or secrets. The vulnerability requires network access to the MCP server interface but no authentication.
Technical details
The render_slides function in packages/cli/src/renderer.ts resolves user-supplied htmlPath arguments to absolute paths and loads them via file:// URLs without validating that the path stays within an intended workspace directory. An attacker with access to the MCP server can traverse the filesystem using absolute paths or directory traversal sequences to render arbitrary readable files into output documents. The vulnerability stems from improper pathname validation (CWE-22) and affects the data flow from user input through handleRender → renderSlides → loadHtml → page.goto().
Affected products
- 06ketan slideshot up to 4.4.0
Timeline
- 2026-08-27: disclosed
- 2026-09-20: advisory