A path traversal vulnerability (CVE-2026-7811) has been discovered in the 54yyyu code-mcp project up to commit 4cfc4643541a110c906d93635b391bf7e357f4a8. The vulnerability affects the is_safe_path function in src/code_mcp/server.py within the MCP File Handler component. This flaw allows remote attackers to perform path traversal attacks. The exploit has been publicly disclosed and is available for use. The project uses rolling releases, making version tracking difficult. Despite early notification through an issue report, the project maintainers have not yet responded to address the vulnerability.