| タイトル | priyankark a11y-mcp 1.0.4 Server-Side Request Forgery |
|---|
| 説明 | priyankark a11y-mcp contains a server-side request forgery (SSRF) vulnerability in src/index.js. The affected MCP request handlers pass an attacker-controlled URL to Puppeteer navigation logic without enforcing a strict destination allowlist or equivalent network restrictions. An attacker who can invoke the vulnerable handlers can cause the server to initiate requests to arbitrary internal or external resources, including loopback, private-address, link-local, or cloud metadata endpoints, subject to network reachability.
|
|---|
| ソース | ⚠️ https://github.com/wing3e/public_exp/issues/17 |
|---|
| ユーザー | BigW (UID 96422) |
|---|
| 送信 | 2026年03月16日 11:47 (7 月 ago) |
|---|
| モデレーション | 2026年04月01日 15:12 (16 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 354655 [priyankark a11y-mcp 迄 1.0.5 src/index.js A11yServer 特権昇格] |
|---|
| ポイント | 20 |
|---|