| عنوان | priyankark a11y-mcp 1.0.4 Server-Side Request Forgery |
|---|
| الوصف | priyankark a11y-mcp contains a server-side request forgery (SSRF) vulnerability in src/index.js. The affected MCP request handlers pass an attacker-controlled URL to Puppeteer navigation logic without enforcing a strict destination allowlist or equivalent network restrictions. An attacker who can invoke the vulnerable handlers can cause the server to initiate requests to arbitrary internal or external resources, including loopback, private-address, link-local, or cloud metadata endpoints, subject to network reachability.
|
|---|
| المصدر | ⚠️ https://github.com/wing3e/public_exp/issues/17 |
|---|
| المستخدم | BigW (UID 96422) |
|---|
| ارسال | 16/03/2026 11:47 AM (7 أشهر منذ) |
|---|
| الاعتدال | 01/04/2026 03:12 PM (16 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 354655 [priyankark a11y-mcp حتى 1.0.5 src/index.js A11yServer تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|