| शीर्षक | AlejandroArciniegas mcp-data-vis 1.0.0 Server-Side Request Forgery |
|---|
| विवरण | AlejandroArciniegas mcp-data-vis contains a server-side request forgery (SSRF) vulnerability in src/servers/web-scraper/server.js. Multiple MCP tools accept an attacker-controlled URL and pass it to outbound HTTP request logic implemented with axios(). Although the code attempts to block some local destinations, the validation is incomplete and does not comprehensively deny private, link-local, or otherwise sensitive address space. An attacker who can invoke the vulnerable handlers can cause the server to send requests to arbitrary internal or external resources that remain reachable after the flawed validation checks. |
|---|
| स्रोत | ⚠️ https://github.com/AlejandroArciniegas/mcp-data-vis/issues/1 |
|---|
| उपयोगकर्ता | MidA (UID 96794) |
|---|
| सबमिशन | 10/04/2026 09:59 AM (2 महीनों पहले) |
|---|
| संयम | 26/04/2026 09:56 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359745 [AlejandroArciniegas mcp-data-vis तक de5a51525a69822290eaee569a1ab447b490746d HTTP Request server.js axios अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|