CVE-2026-74842 in PromptShopMCP
Summary
by MITRE • 08/17/2026
A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The identified vulnerability resides within the Kira-Pgr PromptShopMCP application, specifically affecting versions up to commit 5bc0cd17358e19a5415d11a531088170d7b81452. This security flaw is located in the download_image function within the server.py file of the Image-Toolkit-MCP-Server component. The core technical issue stems from insufficient validation and sanitization of user-supplied input, specifically the image_url argument passed to this function. When an attacker provides a manipulated or maliciously crafted URL, the application fails to restrict the destination domain or protocol scheme appropriately. This lack of rigorous input control allows the server to initiate HTTP requests to arbitrary external hosts on behalf of the client, thereby creating a classic Server-Side Request Forgery scenario.
From a technical perspective, this vulnerability aligns with CWE-918, which defines Server-Side Request Forgery as a condition where an application fetches a remote resource without validating the user-supplied URL. The operational impact is significant because it enables attackers to bypass network access controls and interact with internal services that may not be directly exposed to the public internet. By leveraging this flaw, an adversary can probe internal networks, access sensitive data from local APIs or databases, perform port scanning against internal infrastructure, or even exploit other vulnerabilities in backend systems by crafting requests that appear legitimate coming from the trusted server itself. The ability to initiate these attacks remotely means no prior authentication is necessarily required if the endpoint is publicly accessible, although some SSRF variants may require specific context depending on implementation details not fully disclosed here.
The severity of this issue is further compounded by the fact that an exploit has been made public and is actively usable in the wild. This increases the likelihood of automated attacks targeting systems running vulnerable versions. The project utilizes a rolling release model, which means there are no discrete version numbers to easily identify patched releases. Instead, security updates are delivered continuously as part of ongoing development cycles. Consequently, determining whether a specific deployment is affected requires checking against the commit history or verifying that the codebase includes fixes for input validation in the download_image function after the specified vulnerable commit hash. The lack of response from the project maintainers to early issue reports suggests potential delays in patch availability, leaving users exposed during this window.
To mitigate this risk, immediate remediation strategies should focus on implementing strict allow-listing for permitted URL schemes and destination hosts within the image download logic. Developers must ensure that only expected domains or internal IP ranges are accessible through this function, while blocking requests to private address spaces such as 10.x.x.x, 172.16-31.x.x, and 192.168.x.x, which are commonly targeted in SSRF attacks. Additionally, implementing DNS resolution checks before making the HTTP request can help prevent redirections to internal addresses. For organizations currently running affected versions, it is advisable to monitor official channels for updates that incorporate these validation improvements or to temporarily disable the image download functionality if it is not strictly required for business operations until a secure version is confirmed available. This approach aligns with ATT&CK technique T1598, which covers Phishing for Information or SSRF depending on the specific vector used by attackers in this context.