High severity8.1NVD Advisory· Published Mar 27, 2026· Updated Mar 31, 2026
CVE-2026-33989
CVE-2026-33989
Description
Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the @mobilenext/mobile-mcp server contains a Path Traversal vulnerability in the mobile_save_screenshot and mobile_start_screen_recording tools. The saveTo and output parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@mobilenext/mobile-mcpnpm | < 0.0.49 | 0.0.49 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/mobile-next/mobile-mcp/commit/f5e32295903128c1e71cf915ae6c0b76c7b0153bnvdPatchWEB
- github.com/mobile-next/mobile-mcp/security/advisories/GHSA-3p2m-h2v6-g9mxnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-3p2m-h2v6-g9mxghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33989ghsaADVISORY
- github.com/mobile-next/mobile-mcp/releases/tag/0.0.49nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.