An unauthenticated path traversal vulnerability in the donchelo processing-claude-mcp-bridge allows remote attackers to perform arbitrary file creation or overwrites on the host filesystem.

This is a path traversal vulnerability (CWE-22) occurring in the processing_server.py component. The application fails to sanitize the sketch_name argument, enabling an unauthenticated attacker to escape the intended base directory and write or overwrite files anywhere the service account has permissions.

Successful exploitation grants an attacker the ability to write arbitrary files to the host system, which can lead to remote code execution or significant data integrity compromise. While the CVSS score is 7.3, the potential for arbitrary file overwrites and the existence of a public proof-of-concept elevate the risk to critical for any environment hosting this bridge, particularly on Windows systems where the exploit is most easily demonstrated.

Immediate Action: As no official patch is currently available, disable the create_sketch and update_sketch tools immediately if they are exposed to untrusted environments.

Proactive Monitoring: Monitor filesystem activity for unexpected directory creation or file modifications occurring outside of the designated Processing sketch directory.

Compensating Controls: If the service must remain operational, implement strict input validation on the sketch_name parameter to allow only alphanumeric characters, underscores, and hyphens, while explicitly rejecting any path traversal sequences or separators.

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

Given the ease of exploitation and the potential for full file system manipulation, users of the processing-claude-mcp-bridge must restrict access to the application or disable the vulnerable tool functions until a vendor-supplied patch is released. Prioritize securing the service account running the bridge by adhering to the principle of least privilege to limit the impact of a potential compromise.