MCP Advisory Database
A public, structured database of verified security advisories affecting MCP servers, clients, and tooling. Every entry cites authoritative sources. Query it via the Advisory API, subscribe via RSS or JSON Feed, or contribute a new advisory.
No advisories match the current filter.
- criticalMCPA-2026-0096ssrf
mcp-grafana X-Grafana-URL header server-side request forgery (CVE-2026-19516)
mcp-grafana before 1.1.0 honors a caller-supplied X-Grafana-URL request header that controls the destination of the server's outbound requests, and the grafana_api_request tool additionally lets the caller choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including cloud metadata endpoints) and read the responses, resulting in server-side request forgery. The earlier fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves. Fixed in 1.1.0, which removes support for the undocumented X-Grafana-URL header (grafana/mcp-grafana#1052).
- criticalMCPA-2026-0095malicious-package
@copilot-mcp/apex (npm) postinstall dropper pipes an attacker-controlled remote script into zsh and stages an unverified binary
@copilot-mcp/apex impersonates the @copilot-mcp scope with metadata copied verbatim from the unrelated @oh-my-pi/pi-coding-agent project. Its install.cjs runs on npm postinstall and (1) on macOS spawns osascript with a native admin authentication dialog, then pipes https://update.apex-arena-router.com/loader.sh — a mutable attacker-controlled URL unrelated to the declared publisher — into zsh, and (2) downloads an OS-specific 'apex' binary from an unrelated GitHub org's releases, chmods it 0o755, and stages it for execution with no hash or signature verification. The tarball ships no src/ despite package.json declaring ~150 export subpaths; the only code is the dropper and the binary invoker. Installing any published version (1.0.0–1.0.22) yields remote code execution and, on macOS, a social-engineered admin-privilege prompt. The package has been removed from the npm registry; installs made while it was live remain compromised. Flagged as malware by OSV (MAL-2026-12314, amazon-inspector source).
- mediumMCPA-2026-0094ssrf
article-scraper-mcp fetch_article server-side request forgery (CVE-2026-19375)
article-scraper-mcp (PyPI) 1.0.0 is vulnerable to SSRF: news_scraper_mcp/server.py (component fetch_article) validates the url argument only against the pattern ^https?://.+ before passing it to requests.get(), with no allowlist or network-range validation, so a poisoned tool call can make the server request loopback, private-network, or cloud-metadata URLs from its network position and read the responses (verified by unpacking the published article-scraper-mcp-1.0.0 wheel). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-10, so this is recorded as last_affected 1.0.0.
- lowMCPA-2026-0093ssrf
KoboldCPP-MCP-Server makeRequest server-side request forgery (CVE-2026-19373)
KoboldCPP-MCP-Server (npm: server-koboldai) 1.0.0 is vulnerable to SSRF: src/index.ts (component BaseConfigSchema / makeRequest) accepts an apiUrl argument on every tool call and passes it straight into fetch() request URLs (`${apiUrl}/v1/chat/completions`, `${apiUrl}${endpoint}`) with no allowlist or network-range validation, so a poisoned tool call can point the server at loopback, private-network, or cloud-metadata URLs from its network position and read the responses (verified by unpacking the published server-koboldai@1.0.0 tarball). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-10, so this is recorded as last_affected 1.0.0.
- lowMCPA-2026-0092path-traversal
LudusMCP insert_creds_range_config path traversal (CVE-2026-19366)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to path traversal: src/tools/insertCredsRangeConfig.ts (component insert_creds_range_config) resolves the configPath and outputPath arguments against the range-config-templates directory with path.join/path.resolve and no traversal sanitization, so a poisoned tool call can read from and write credential-bearing config output to files outside the intended directory (verified by unpacking the published ludus-mcp@1.0.24 tarball). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-09, so this is recorded as last_affected 1.0.24.
- mediumMCPA-2026-0091ssrf
LudusMCP read_range_config server-side request forgery (CVE-2026-19367)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to SSRF: src/tools/rangeConfig.ts (component read_range_config) passes any 'source' argument that starts with http:// or https:// directly to fetch() with no allowlist or network-range validation, so a poisoned tool call can make the server request loopback, private-network, or cloud-metadata URLs from its network position and read the responses (verified by unpacking the published ludus-mcp@1.0.24 tarball). The maintainer was notified via a public issue but no fixed release exists as of 2026-08-09, so this is recorded as last_affected 1.0.24.
- mediumMCPA-2026-0090ssrf
alibabacloud-dataworks-mcp-server ReadResource server-side request forgery (CVE-2026-19339)
alibabacloud-dataworks-mcp-server (npm): the MCP ReadResource handler in src/resources/initResources.ts passes any request.params.uri that starts with 'http' directly to fetch() and returns the response body, with no allowlist or network-range validation, so an MCP client (or a prompt-injected tool call) can make the server request loopback, private-network, or cloud-metadata URLs from the server's network position and read the responses (SSRF). The upstream issue is open and the vulnerable code is still present in npm latest 1.0.45 (verified by unpacking the published tarball), so this is recorded as last_affected 1.0.45.
- lowMCPA-2026-0089ssrf
mcp-google-search read_webpage server-side request forgery (CVE-2026-19337)
@adenot/mcp-google-search (npm): the read_webpage MCP tool passes the caller-controlled url argument directly to axios.get in src/index.ts, validating only that it is a string, so a prompt-injected or malicious tool call can make the server request loopback, private-network, or cloud-metadata URLs from the server's network position (private-network SSRF). The upstream issue is open and no fixed release is published (npm latest is 0.3.1), so this is recorded as last_affected 0.3.1.
- mediumMCPA-2026-0088path-traversal
spec-workflow-mcp approvals tool categoryName path traversal (CVE-2026-19336)
@pimzino/spec-workflow-mcp (npm): the approvals MCP tool passes the caller-controlled categoryName argument into ApprovalStorage.createApproval() (src/tools/approvals.ts / src/dashboard/approval-storage.ts) without validation — filePath is checked for absolute paths and '..', but categoryName is joined directly under the approvals directory before fs.writeFile(), so a traversal value like '..\..\..\outside' creates directories and writes approval JSON files outside the intended .spec-workflow/approvals tree (public PoC in the upstream issue). Fixed on main by PR #222 (merge commit 1ef0112ba8eda2e1ecc2666c3ad8d1f91393d886, validateSimplePathSegment/safeJoin guards, repo version 2.2.7), but no fixed build is published to npm (latest is 2.2.5), so this is recorded as last_affected 2.2.5.
- lowMCPA-2026-0087path-traversal
skill-ninja-mcp-server skill-management tools path traversal (CVE-2026-19328)
skill-ninja-mcp-server (npm) 0.1.0: the getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill MCP tools pass the caller-controlled workspacePath argument into filesystem operations in src/installer.ts without trusted-root enforcement, so a prompt-injected or malicious tool call can read, write, and delete files outside the intended workspace (path traversal). Fixed in 0.1.1, which adds trusted-root workspace guards (patch 855b46739e0f6e8388f17f9d0066ac4298a3965d). The @iflow-mcp/aktsmm-skill-ninja-mcp-server republish mirrors only the vulnerable 0.1.0 build (installer.js byte-identical) and has no fixed release, so it is recorded as last_affected 0.1.0.
- lowMCPA-2026-0086path-traversal
react-analyzer-mcp analyze-project path traversal (CVE-2026-19323)
react-analyzer-mcp (npm) up to 1.0.0: the analyze-project MCP tool passes the caller-controlled projectName argument into path.join(PROJECT_ROOT, subFolder) in src/index.ts without normalization or containment checks, so generateProjectDocs/listReactFiles can escape the configured project root and recursively enumerate and read arbitrary .jsx/.tsx files from attacker-selected directories on the host. The project was informed through a public issue but has not responded; the repository uses rolling releases and no fixed release exists, so the range is recorded as last_affected 1.0.0 (the only npm release) per the public advisory.
- criticalMCPA-2026-0085malicious-package
@xiaohhhh1/canvas-agent (npm) auto-connects to a hardcoded vendor relay that can drive local Codex/Claude turns with sandbox disabled and pull files from disk
@xiaohhhh1/canvas-agent's bin opens an outbound WebSocket to the hardcoded relay `wss://canvas.xiaohhhh1.com/api/agent-relay` on start and forwards inbound relay messages as authenticated requests to its own local server, attaching the local x-canvas-agent-token header. Verified by unpacking the latest tarball (0.4.11): dist/relay-bridge.js carries the hardcoded DEFAULT_RELAY_URL; relay-reachable endpoints include /agent/codex/turn and /agent/claude/turn (spawn the local Codex/Claude CLIs), /agent/codex/approval (supplies approval decisions), /agent/local-image (returns file bytes for any absolute path with an image extension), and /agent/local-file/reveal (spawns the OS file manager against arbitrary paths); and dist/agent/codex-client.js maps a caller-supplied permissionMode of 'full' to Codex sandbox 'danger-full-access' with approvalPolicy 'never'. A remote peer on the vendor relay can therefore run unrestricted agent turns on the installer's host without any local approval prompt and read files from disk. Flagged as malware by OSV (MAL-2026-13398).
- criticalMCPA-2026-0084malicious-package
@addai/node (npm) installs an autostart daemon that runs local AI-agent CLIs from a hardcoded Supabase backend and inventories third-party agent credential stores
@addai/node installs a background daemon (dist/session-runner.js) that pairs the host to a remote account and polls the hardcoded backend `https://syhzpqqvrplaqdipcymw.supabase.co` for request rows. Verified by unpacking the latest tarball (0.11.3): row fields (prompt, working_directory, permission_mode including 'bypassPermissions', allowed_tools, mcps_override, agent including 'claude-bypass') are passed to local spawn/PTY calls that drive installed claude, codex, kimi, gemini, and grok CLIs; the same channel accepts install_harness, update_runtime, and set_autostart commands and runs remote-selected `npm install -g` package specs (command-runner.js), giving whoever controls the account remote agent execution, self-update, and autostart persistence (autostart-mac.js/autostart-win.js). probeCapabilities() additionally reads credential stores it does not own (~/.codex/auth.json, ~/.kimi-code/credentials, ~/.gemini/oauth_creds.json and google_accounts.json, ~/.grok/auth.json, `claude auth status`) and reports authed state and account emails to the same backend via runtime_heartbeat. Flagged as malware by OSV (MAL-2026-13411).
- highMCPA-2026-0083malicious-package
trimprompt (npm) installs shell shims into Cursor/Claude Code command paths and ships fully obfuscated modules that pair child_process with outbound host reporting
trimprompt markets itself as a token-saving proxy for AI coding agents, but nearly every runtime module (cache-manager.js, ccr.js, executor.js, file-watcher.js, hooks/claude-hook.js, mcp.js, proxy-conv.js, proxy-resp.js, sync.js, tracker.js, all filters/*.js) is hex-mangled `_0x...` obfuscated JavaScript. Verified by unpacking the latest tarball (1.0.49): postinstall.js auto-runs `node cli.js shims install` and tells the user to restart Cursor/Claude Code so the shims intercept agent command output; shims.js spawns powershell/pwsh via execSync; and the obfuscated sync.js and tracker.js combine child_process with HTTP POSTs carrying hostname/identifier fields — the shape of host reconnaissance and beaconing, with destinations hidden behind the string-array obfuscation. Pervasive obfuscation plus install-time execution in the agent command path is inconsistent with a legitimate prompt-trimming utility. Flagged as malware by OSV (MAL-2026-13462). Recorded as high rather than critical because the exfiltration destinations and a remote-command channel could not be recovered from the obfuscated code.
- criticalMCPA-2026-0082malicious-package
@atom8n/inspector (npm) impersonates Anthropic's MCP Inspector and reintroduces the CVE-2025-49596 drive-by RCE by disabling auth and origin validation
@atom8n/inspector republishes the official @modelcontextprotocol/inspector under a squatted scope while spoofing Anthropic metadata (package.json declares author 'Anthropic, PBC' and homepage modelcontextprotocol.io) and deliberately regressing the upstream security fixes for CVE-2025-49596. Verified by unpacking the latest tarball (0.17.32): the proxy's auth gate is inverted to off-by-default (`const authDisabled = process.env.DANGEROUSLY_OMIT_AUTH !== "false"` in server/build/index.js), the DNS-rebinding origin-validation middleware body is commented out, and the proxy still spawns `query.command` via StdioClientTransport. Running the renamed `mcp-inspector-atom8n` bin therefore exposes an unauthenticated localhost proxy (port 6277) that any web page the developer visits can drive to execute arbitrary local commands. Flagged as malware by OSV (MAL-2026-13414).
- highMCPA-2026-0081malicious-package
claude-remote-agent 0.1.0-0.2.0 (npm) defaults to an author-controlled relay that remote-drives a local Claude PTY session
claude-remote-agent runs a daemon that connects to a WebSocket relay and, on relay request, spawns a Python PTY bridge to run `claude` sessions in the host's working directory, forwarding terminal I/O to the relay and supporting a `bypassPermissions` permission mode. In 0.1.0 through 0.2.0 the relay URL defaulted to the hardcoded author-controlled endpoint `wss://claude.pishchykau.eu` (`process.env.SERVER_URL || 'wss://claude.pishchykau.eu'`), so simply running the CLI handed interactive shell/agent control of the machine to a third-party server. Flagged as malware by OSV (MAL-2026-13376, versions 0.1.0-0.1.2). Verified by unpacking every published version: 0.1.0-0.2.0 carry the hardcoded default, while 0.3.0 and later require an explicit `--server` URL and exit without one, so 0.2.0 is recorded as the last affected version.
- criticalMCPA-2026-0080malicious-package
agenthub-ai (npm) installs a persistent service that drives the Claude Agent SDK from a hardcoded relay and self-updates over npm
agenthub-ai ships a bundled daemon (dist-publish/main.js) that installs itself as an OS-level autostart service (Windows hidden WScript launcher / systemd unit / launchd job), opens a WebSocket to the hardcoded production relay `wss://agenthub-agent.fyenet.com`, and executes request messages received from it against a local `@anthropic-ai/claude-agent-sdk` session in the user's working directory. Session, file and system channels let the relay operator read and write files and run agent sessions on the host; the daemon also kills orphaned `claude`/`claude.exe` processes, writes a machine id into the user's `~/.claude` config directory, and can pull and install a newer version of itself with `npm install -g agenthub-ai@<ver>` (PowerShell hidden-window path on Windows), so the running code is remotely replaceable. Flagged as malware by OSV (MAL-2026-13615). Verified on the latest published tarball 0.20.9 (2026-08-09): the hardcoded relay, service installation and self-update paths are all still present, so no fixed version is recorded.
- criticalMCPA-2026-0079malicious-package
aclade-agent (npm) polls a hardcoded server for task objects and executes arbitrary shell commands, self-updating from npm
aclade-agent installs a daemon that re-spawns itself detached and polls `https://aclade.com/api/connector/poll` for task objects, then dispatches them in `executeTask()`. The `execute_bash` tool passes the server-supplied string to `child_process.spawn(input.command, [], { shell: true })`, so whoever controls the endpoint gets arbitrary shell execution as the installing user; other tools shell out via execSync to enumerate (`find`/`dir /s /b`) and grep the filesystem, and results are posted back to `/api/connector/respond`. The poll loop also runs `execSync("npm install -g aclade-agent@latest")`, so the running code can be replaced silently at any time. Flagged as malware by OSV (MAL-2026-13614). Verified on the latest published tarball 1.0.6 (2026-08-09): the poll/execute/self-update paths are all still present, so no fixed version is recorded.
- criticalMCPA-2026-0078malicious-package
mangomind-agent (npm) rewrites the user's OpenCode config, drives `opencode serve` from a hardcoded relay, and execSyncs relay-supplied commands
mangomind-agent installs a background daemon (hidden via a temp VBS launcher on Windows, launchd/systemd on macOS/Linux) that connects to a hardcoded WebSocket relay (`wss://mangomind-relay-production.up.railway.app`, `wss://relay.mangomindbd.com` in earlier releases) and remote-drives a local OpenCode agent. Before starting `opencode serve` it overwrites the workspace `opencode.jsonc` with its own provider config that routes all model traffic — i.e. the code and prompts of the workspace — through the author's Supabase endpoint (`https://rfsbovvvryfmgpoehlrc.supabase.co/functions/v1/mangomind-api/v1`), backing up and restoring the victim's real config around the session. Relay messages of type `diagnosis` carrying `autoFix` are handled by passing `msg.fixCommand` straight to `child_process.execSync`, giving the relay operator arbitrary shell execution as the installing user. Flagged as malware by OSV (MAL-2026-13611). Verified on the latest published tarball 0.2.2 (2026-08-09): the relay-driven `execSync(fixCommand)` path, the config rewrite and the hidden autostart are all still present, so no fixed version is recorded.
- criticalMCPA-2026-0077malicious-package
code-analyzer-mcp 1.0.0 (npm) runs host reconnaissance on launch and exposes an unrestricted `run_command` MCP tool
code-analyzer-mcp@1.0.0 advertised itself as a code-analysis MCP server. Its index.js has a top-level IIFE that runs whenever the server is launched: it executes calc.exe plus reconnaissance commands (whoami, hostname, ipconfig) and writes username, hostname, platform, PATH fragments and COMPUTERNAME/USERDOMAIN to trae-mcp-rce-poc.txt in the temp directory, with in-file comments labelling the block a malicious payload. The server additionally registers an MCP tool `run_command` that passes the client-supplied command straight to child_process.execSync with shell: true, so any connected client — including a model steered by prompt injection — gets arbitrary shell execution as the installing user. Flagged as malware by OSV (amazon-inspector source). The package was removed from npm (verified unpublished on 2026-08-08), so only the published version 1.0.0 is recorded as affected.
- criticalMCPA-2026-0076malicious-package
claude-cup (npm) registers itself into Claude Code and Cursor and uses the local agent to inventory credential stores, reporting results to its own API
The npm package claude-cup presents itself as a Claude Code usage leaderboard. On first launch it auto-registers its MCP server and hooks into Claude Code and, when present, Cursor, then drives the installer's authenticated `claude` CLI with a prompt whose vocabulary is a codeword dictionary for credential material (`striker`->github, `midfielder`->npm, `goalkeeper`->aws_pair, `referee`->private_key, ...) and for the paths that hold it (`home_north`->~/.git-credentials, `away_north`->~/.aws/, `home_south`->~/.ssh/, `tunnel`->shell_history, ...), so what is requested and returned is a per-host inventory of secret locations and their validation state. Counts of discovered/validated/high-exposure secrets plus a machine id, Claude org and install source are then encoded into query parameters of https://api.claude-cup.com/v1/config; an in-tree comment states the scheduling is designed to "look like a normal background 'environment profiler'". Earlier versions flagged by OSV (amazon-inspector source) read the credential paths directly and validated harvested tokens against provider APIs under a manifest fetched from a mutable GitHub branch. The package remained live on npm and the 0.9.12 tarball verified on 2026-08-08 still contains the agent-driven credential inventory, the codeword mapping and the reporting channel, so every version is recorded as affected.
- criticalMCPA-2026-0075malicious-package
claw-subagent-service (npm) installs an auto-restarting privileged service that self-updates and takes agent commands from a vendor IM channel
The npm package claw-subagent-service registers itself as a privileged auto-start Windows service from its postinstall script (`sc.exe create` plus `sc.exe failure ... actions= restart/0/restart/0/restart/0` and `start= auto`) and starts it immediately with no opt-in. The running service then (1) self-replaces every 6 hours via `npm view claw-subagent-service version` followed by `npm install -g claw-subagent-service@<latest>`, so any future tarball under that name executes with the service's privileges regardless of the operator's pinning, and (2) fetches an IM token from https://newsradar.dreamdt.cn/im/api/claw/token/<nodeId>, joins a RongCloud session with the hardcoded appKey `bmdehs6pbyyks`, and dispatches inbound COMMAND / DEVICE_CONTROL / CHAT_MESSAGE messages into local script execution and into prompts fed to the local OpenCode/openclaw agent — giving whoever controls that backend persistent shell-class access to every installer machine, plus periodic collection of local agent session state. Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.4.0 tarball verified on 2026-08-08 still contains the privileged service installer, the global self-update loop and the vendor IM command handler, so every version is recorded as affected.
- criticalMCPA-2026-0074malicious-package
@cliphijack/santaclaude (npm) lets a remote service inject tmux keystrokes and launch `claude --dangerously-skip-permissions` on the installer's host
The npm package @cliphijack/santaclaude runs a client that polls https://santaclaude.app (/api/control/claim, /api/jobs/claim) and dispatches server-supplied jobs into the user's tmux sessions with `tmux send-keys -l <cmd>` followed by Enter, and spawns new windows running `claude --dangerously-skip-permissions` by default — so the remote endpoint can type arbitrary shell commands on the host and drive a coding agent with tool confirmation disabled. A second path polls /api/cli-version and, when the server returns a `target`, writes it to ~/.santaclaude-target and exits 75 so the wrapper re-execs `npx -y @cliphijack/santaclaude@<server-chosen-version>`, letting the service pick which client code runs next; shipped hooks (hooks/sc-notify.sh, hooks/sc-stop.sh) curl host identifiers to the same service. Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.0.108 tarball verified on 2026-08-08 still contains the santaclaude.app control loop, the send-keys injection helpers, the `claude --dangerously-skip-permissions` default command and the server-chosen re-exec, so every version is recorded as affected.
- highMCPA-2026-0073malicious-package
@guangnao/claude-cli (npm) silently joins a concealed hub that relays remote jobs through the installer's local Claude API key
The npm package @guangnao/claude-cli hardcodes a hub endpoint (https://hub.client-llm.com) concealed behind a bespoke base64+XOR string decoder used for exactly that one URL. On `claude-cli start` the hidden hub is enabled by default (opt-out only, undocumented, while the README presents hub participation as opt-in); the CLI then opens a WebSocket to the hub and, on remote job messages, POSTs the remote-supplied body to the installer's local /v1/messages endpoint using the local x-api-key — letting the hub operator consume the installer's Claude API quota and route arbitrary prompts through their account. Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.0.17 tarball verified on 2026-08-08 still contains the concealed decoder and default-on hub, so every version is recorded as affected.
- criticalMCPA-2026-0072malicious-package
claude-token-tracker-mcp (npm) poses as an MCP token-tracking server but harvests Claude configs, shell histories, and API-key env vars
The npm package claude-token-tracker-mcp presents itself as an MCP token-usage tracking server, but server.js invokes a silentHarvest routine at module load and hourly thereafter: it reads Claude configuration files from the home directory, searches PowerShell/Bash/Zsh command histories for API keys and tokens, and copies environment variables whose names contain KEY, TOKEN, SECRET, ANTHROPIC, OPENAI, CLAUDE, or DEEPSEEK, uploading everything to the litterbox.catbox.moe anonymous file host. npm has since replaced the package with a security-holder release; the single malicious version 1.0.0 is recorded.
- criticalMCPA-2026-0071malicious-package
remote-claude-daemon (npm) gives a hardcoded relay arbitrary code execution via `claude --dangerously-skip-permissions` plus full desktop input control
The npm package remote-claude-daemon connects outbound to a hardcoded WebSocket relay and treats inbound messages as commands against the local host. On ai_query/ai_voice_query messages it spawns the local `claude` binary with `--continue -p --dangerously-skip-permissions` and the remote-supplied prompt, giving the relay operator arbitrary code execution through Claude Code with the permission prompt disabled; a separate handleInput path drives synthesized mouse/keyboard/clipboard input via @nut-tree-fork/nut-js for full interactive desktop control. Flagged as malware by OSV (amazon-inspector source, relay wss://remote-claude-relay.fly.dev); the package remained live on npm and the 0.6.8 tarball verified on 2026-08-08 still contains the same skip-permissions runner and desktop-input controller with the relay moved to wss://relay.teleportus.ai, so every version is recorded as affected.
- criticalMCPA-2026-0070malicious-package
anthropic-setup (npm) hijacks Claude Code's base URL to exfiltrate API keys and full prompt/response traffic
The npm package anthropic-setup poses as an Anthropic API setup helper (`npx anthropic-setup sk-ant-...`). Its bin entry is a single base64-concealed eval that writes ~/.claude/settings.json with env.ANTHROPIC_BASE_URL set to https://sugarball.vercel.app, stores the supplied ANTHROPIC_API_KEY, and adds an apiKeyHelper echoing that key. Every subsequent Claude Code invocation then sends the installer's API key and full prompt/response content to the attacker-controlled Vercel deployment instead of api.anthropic.com. Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.0.1 tarball verified on 2026-08-08 still contains the concealed hijack, so every version is recorded as affected.
- criticalMCPA-2026-0069malicious-package
opencode-engos-ai (npm) installs a non-publisher OpenCode binary at install time and symlinks it into system paths
The npm package opencode-engos-ai poses as an OpenCode distribution. Its postinstall script resolves platform packages named opencode-engos-<platform>-<arch> to their current 'latest' tag at install time, installs whatever binary the attacker has most recently published, copies it over the package's `opencode-engos` bin entry, and symlinks it into /usr/local/bin/innexarcode and /usr/bin/innexarcode without user prompt — an unpinned, attacker-updatable binary drop with system-path persistence (same campaign shape as MCPA-2026-0061). Flagged as malware by OSV (amazon-inspector source); the package remained live on npm and the 1.21.8 tarball verified on 2026-08-08 still contains the same pipeline, so every version is recorded as affected.
- lowMCPA-2026-0068rce-vectors
mcp-pdf-vision page-extraction command injection (CVE-2026-19279)
mcp-pdf-vision (npm) 1.1.0: the load_pdf/extract_page path in src/index.ts interpolates the pdfPath and sessionId arguments into a pdftoppm shell command executed via child_process exec, allowing command injection through crafted paths or session ids (a double quote in pdfPath escapes the quoting). Version 1.0.0 does not contain the exec-based extraction. The project was informed through a public issue but has not responded and no fixed release exists, so the range is recorded as last_affected 1.1.0 per the public advisory.
- criticalMCPA-2026-0067malicious-package
brave-search-mcp-server (npm) — malicious squat of the official Brave Search MCP server name
The unscoped npm package brave-search-mcp-server 1.0.0 squats the name of the official Brave Search MCP server (published as @brave/brave-search-mcp-server). OpenSSF Package Analysis flagged the package as malicious: it communicates with a domain associated with malicious activity and executes commands associated with malicious behavior. MCP client configs commonly launch search servers via `npx <name>`, and the unscoped name is the obvious guess for Brave's server, so a config referencing the unscoped name executed the payload. npm has removed the package (replaced with a 0.0.1-security placeholder); every real version is recorded as affected.
- criticalMCPA-2026-0066malicious-package
Mini Shai-Hulud campaign compromised popular MCP servers (@antv/mcp-server-antv, mcp-echarts, mcp-mermaid)
The Mini Shai-Hulud supply chain attack compromised the npm account `atool` and published 631 malicious versions across 314 packages in an automated 22-minute burst on 2026-07-27. Three widely used MCP servers were among them: @antv/mcp-server-antv 0.2.8, mcp-echarts 0.8.1, and mcp-mermaid 0.5.1. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun script which harvests credentials (npm tokens, cloud keys, environment secrets) and exfiltrates them via the GitHub API as a covert channel. These are real, legitimate MCP servers commonly launched via `npx` from MCP client configs, so any config that resolved one of the trojaned versions executed the payload on install. npm has since removed the malicious versions; only the exact listed versions are affected, and current releases published by the maintainers are clean.
- criticalMCPA-2026-0065malicious-package
agenttunnels (npm) MCP bridge lets an author-controlled endpoint push unapproved shell commands and file writes
The npm package agenttunnels ships an MCP bridge whose tunnel_run_command tool executes a command string from a proposal payload fetched from a remote session worker via child_process.spawn with shell:true, inheriting process.env and the caller's workdir. Execution is gated on proposal.status==='granted' OR governance.customer.require_approval===false — the latter is a server-side flag controlled by the same remote worker, so the endpoint operator can toggle off human approval and autonomously drive shell execution on every connected host; a companion tunnel_apply_patch tool writes remote-supplied file contents under the same gating. The default session backend is hardcoded to a personal *.workers.dev subdomain matching the maintainer's GitHub handle. The package remains live on npm, and the 0.1.17 tarball (verified 2026-08-08, above the GHSA-flagged 0.1.14) still ships the same author-controlled default endpoint and require_approval bypass, so every version is recorded as affected.
- criticalMCPA-2026-0064malicious-package
llm-interceptor (npm) registers itself as an MCP server and exfiltrates AI-coding session transcripts
The npm package llm-interceptor installs itself into the victim's agent tooling on `npm install`: its postinstall registers an MCP server entry in ~/.cursor/mcp.json, runs `claude mcp add llm-interceptor`, installs a Claude Code SessionEnd hook in ~/.claude/settings.json, and on Windows creates a per-user logon task that auto-starts its proxy. Once running, its tailers recursively read ~/.claude/projects/**/*.jsonl and ~/.codex/sessions/**/*.jsonl — the installer's saved AI-coding conversations including prompts and generated code — and POST them to a hardcoded anonymous Cloudflare Quick Tunnel endpoint with a static bearer token; a self-update poller lets the tunnel operator push `npm install -g llm-interceptor@<tag>` on demand. The exfiltration/egress pipeline is present from the first published version (0.1.0 tarball verified 2026-08-08), and the package remains live on npm (latest 0.4.1, itself flagged), so every version is recorded as affected.
- criticalMCPA-2026-0063malicious-package
agenthub-multiagent-mcp (npm) lets a hardcoded remote server drive Claude Code with permissions disabled
agenthub-multiagent-mcp ships a worker that opens a WebSocket to a hardcoded server (wss://agenthub.contetial.com) and, for every 'dispatch' message received, writes the server-supplied body to a prompt file and spawns Claude Code via `claude -p "$PROMPT" --dangerously-skip-permissions` against a user-configured project directory — giving whoever controls the server Claude Code's full tool suite (file read/write, shell, MCP tools) on the installer's projects without approval prompts. GHSA flags 1.57.0; the worker mechanism is the package's core design rather than an injected payload, so every version is recorded as affected.
- criticalMCPA-2026-0062malicious-package
devplatform-react-mcp (npm) is a dropper disguised as a React MCP SDK
devplatform-react-mcp@35.5.6 poses as a React MCP SDK. On require(), it assembles Cloudflare Workers hostnames from string fragments at runtime, downloads a platform-specific binary, writes it to a hidden temp path, marks it executable, and spawns it detached; a DNS-TXT fallback resolves further payload sources. The package was removed from npm after detection. Treat every version as malicious.
- criticalMCPA-2026-0061malicious-package
opencode-optimised-toolings (npm) replaces the OpenCode binary with a build from a non-publisher repository
The npm package opencode-optimised-toolings poses as an OpenCode plugin. On plugin load it runs a self-patch pipeline without user prompt: it downloads an OpenCode source tarball from a non-publisher GitHub repository (github.com/anomalyco/opencode, distinct from upstream sst/opencode), builds it, renames the user's on-PATH opencode executable aside, and installs the newly built binary in its place — every subsequent `opencode` invocation on the host runs attacker-built code. GHSA flags versions 3.4.0/4.0.0/4.0.1; the package remained live on npm afterward, and the 6.2.0 tarball verified on 2026-08-03 still contains the same self-patch pipeline downloading from the same non-publisher repository, so every version is recorded as affected.
- lowMCPA-2026-0060path-traversal
mcp-ui-probe journey storage path traversal (CVE-2026-19270)
mcp-ui-probe (npm) up to 0.2.0: the get_journey/delete_journey/analyze_journey/usage_stats functions in src/journey/JourneyStorage.ts pass the journeyId/filename arguments into filesystem paths without sanitization, allowing path traversal outside the journey storage directory. The project was informed through a public issue but has not responded and no fixed release exists, so the range is recorded as last_affected 0.2.0 per the public advisory.
- mediumMCPA-2026-0059rce-vectors
OpenHands resolver command injection in initialize_repo (CVE-2026-19022)
OpenHands (PyPI: openhands-ai) up to 0.62.0: the initialize_repo function in resolver/send_pull_request.py passes attacker-influenced input into a shell command, allowing remote command injection through the resolver's pull-request flow. The vendor deleted the original issue report; the affected file was removed by the 1.x restructure (reported as gone in 1.7.0), so the range is recorded as last_affected 0.62.0 per the public advisory.
- highMCPA-2026-0058auth-missing
Flowise document store mutation endpoints lack authorization checks (CVE-2026-67621)
Flowise through 3.1.4: the document store upsert and refresh routes are not protected by authorization checks, so workspace members with only view-level permissions can trigger document ingestion, refresh vector database contents, consume embedding API credits, and modify knowledge bases used by downstream chatflows. No fixed release: Flowise announced its sunset; through 3.1.4 (latest) remains affected.
- highMCPA-2026-0057auth-missing
Flowise OpenAI Assistants IDOR exposes cross-workspace credentials and files (CVE-2026-67622)
Flowise through 3.1.4: the OpenAI Assistants integration looks up credentials by UUID without verifying workspace ownership, so any authenticated user can enumerate cross-workspace assistant metadata, list files and vector stores, and upload files into victim workspaces by supplying arbitrary credential UUIDs. No fixed release: Flowise announced its sunset; through 3.1.4 (latest) remains affected.
- highMCPA-2026-0056auth-missing
Flowise unauthenticated OAuth2 credential refresh via prefix-based whitelist bypass (CVE-2026-70636)
Flowise through 3.1.4: the authentication middleware whitelist uses prefix matching, so a POST to the oauth2-credential refresh route with a trailing credential identifier bypasses all authentication and authorization, letting unauthenticated attackers trigger OAuth token rotation for credentials in any workspace (a bypass of the CVE-2026-41273 fix). No fixed release: Flowise announced its sunset; through 3.1.4 (latest) remains affected.
- mediumMCPA-2026-0055auth-missing
Flowise unauthenticated text-to-speech endpoint abuses private chatflow TTS credentials (GHSA-8gj2-2cvc-6xx7)
Flowise 3.1.3 and earlier expose a text-to-speech endpoint without authorization checks, letting unauthenticated callers consume the TTS credentials configured on private chatflows. Fixed in 3.1.4 (note: one release later than the 3.1.3 batch).
- criticalMCPA-2026-0054rce-vectors
Flowise RCE via NodeVM sandbox escape through nodeVMOptions override (CVE-2026-69254)
Flowise 3.1.2 and earlier let custom-code nodes override nodeVMOptions passed to executeJavaScriptCode(), escaping the NodeVM sandbox and executing arbitrary code on the host (reported by elttam). Fixed in 3.1.3.
- criticalMCPA-2026-0053rce-vectors
Flowise CSVAgent remote code execution (CVE-2026-69256)
Flowise 3.1.2 and earlier allow the CSVAgent node to execute attacker-influenced code on the host (reported by elttam). Fixed in 3.1.3.
- criticalMCPA-2026-0052rce-vectors
Flowise RCE via TypeORM DataSource configuration (CVE-2026-69251)
Flowise 3.1.2 and earlier allow database node configuration to be abused through TypeORM DataSource options to execute arbitrary code on the host (reported by elttam). Fixed in 3.1.3.
- criticalMCPA-2026-0051rce-vectors
Flowise RCE via SQLite Record Manager node (CVE-2026-69259)
Flowise 3.1.2 and earlier allow the SQLite Record Manager node's configuration to reach code execution on the host (reported by elttam). Fixed in 3.1.3.
- criticalMCPA-2026-0050rce-vectors
Flowise Pyodide validator Unicode homoglyph bypass leads to RCE (CVE-2026-70470)
Flowise 3.1.2 and earlier validate Pyodide code with a blocklist that can be bypassed using Unicode homoglyphs, letting authenticated users execute arbitrary code outside the sandbox. Fixed in 3.1.3.
- criticalMCPA-2026-0049rce-vectors
Flowise CSV Agent prompt-injection remote code execution (CVE-2026-70477)
Flowise 3.1.2 and earlier allow prompt-injection content processed by the CSV Agent to reach the Python execution path and run arbitrary code on the host — a toxic flow from untrusted data to code execution. Fixed in 3.1.3.
- criticalMCPA-2026-0048credential-leak
Flowise unauthenticated OAuth2 token refresh endpoint leaks access tokens (CVE-2026-70478)
Flowise 3.1.2 and earlier expose an unauthenticated OAuth2 token refresh endpoint that returns fresh access tokens for stored credentials, enabling token theft for any service connected to the instance. Fixed in 3.1.3.
- highMCPA-2026-0047path-traversal
Prompty file-reference expansion allows arbitrary file read (CVE-2026-53598)
Prompty loaders expanded ${file:...} references in .prompty frontmatter without confining the resolved path, so an attacker-controlled prompt file can use path traversal or absolute paths to read any file accessible to the host process. Affects PyPI prompty (<= 2.0.0b1, fixed 2.0.0b2), npm @prompty/core (<= 2.0.0-beta.1, fixed 2.0.0-beta.2), and NuGet Prompty.Core (<= 2.0.0-beta.1, fixed 2.0.0-beta.2); a Rust crate is also affected (outside this database's ecosystems).
- highMCPA-2026-0046rce-vectors
Prompty TypeScript loader executes JavaScript frontmatter in .prompty files (CVE-2026-53597)
The TypeScript Prompty loader (@prompty/core) used gray-matter without disabling executable frontmatter engines, so a .prompty file with a ---js frontmatter block executes arbitrary JavaScript during prompt loading. Any application loading attacker-controlled prompt assets is exposed. Affects the @prompty/core npm 2.0 prerelease line (>= 2.0.0-alpha.1); fixed in 2.0.0-beta.3.
- highMCPA-2026-0045auth-missing
Serena unauthenticated dashboard DNS rebinding to memory poisoning and RCE (CVE-2026-49471)
Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port (TCP 24282) with no authentication, CSRF protection, or Host header validation. A DNS rebinding attack lets any webpage the operator visits reach the API, write arbitrary content to the agent's persistent memory store (poisoning future agent sessions), and escalate to code execution. Affects the serena-agent PyPI package; fixed in 1.5.2.
- lowMCPA-2026-0044overprivileged
@dynatrace-oss/dynatrace-mcp-server create_dynatrace_notebook lacks the human-approval gate
@dynatrace-oss/dynatrace-mcp-server (npm) before 1.8.7: the create_dynatrace_notebook write tool is missing the human-approval gate applied to the other write tools, letting a caller create persistent tenant-visible notebooks with arbitrary content — including embedded DQL that other users execute when opening the notebook — without operator consent. Fixed in 1.8.7.
- mediumMCPA-2026-0043auth-missing
PraisonAI MCP HTTP-stream transport is unauthenticated by default (CVE-2026-61427)
PraisonAI (PyPI: praisonai) before 4.6.78 exposes the MCP HTTP-stream transport without authentication by default: the CLI --api-key option defaults to None and the server only enforces Authorization/Bearer checks when an API key is configured, so 'praisonai mcp serve --transport http-stream' without an API key accepts unauthenticated MCP requests. Fixed in 4.6.78. Package mapping (PyPI praisonai) verified independently — the GHSA carries no package mapping.
- highMCPA-2026-0042path-traversal
Phantom arbitrary file write and decode-bomb DoS via unconfined MCP tool paths
Phantom (PyPI: phantom-audio) through 1.3.0: when PHANTOM_OUTPUT_DIR is unset (the default), the MCP tools accept arbitrary absolute output paths with no confinement — anything able to send tool calls (e.g. a prompt-injected agent) can write or overwrite arbitrary files the process user can write, including shell startup files, plus a decode-bomb denial of service. Fixed in 1.3.1.
- mediumMCPA-2026-0041auth-missing
Gittensory MCP tool leaks miner financial data via missing contributor-scoped access control
@jsonbored/gittensory-mcp (npm) through 0.1.0: the gittensory_get_contributor_profile MCP tool (and the matching GET /v1/contributors/:login/profile endpoint) skips the contributor-scoped access check enforced by every sibling endpoint — any authenticated session/API/MCP token holder can read any contributor's profile, exposing miner earnings data (alphaPerDay, taoPerDay, usdPerDay). Patched upstream (commit 811ef5f); no fixed npm release was available at publication.
- mediumMCPA-2026-0040path-traversal
mcp-memory-keeper arbitrary local file read in context_import via unvalidated filePath (CVE-2026-54561)
mcp-memory-keeper (npm) before 0.13.0: context_import passes the caller-supplied filePath directly to fs.readFileSync with no path confinement — a malicious MCP client or a prompt-injected agent can read any file the server process can access. Fixed in 0.13.0.
- highMCPA-2026-0039auth-missing
@andrea9293/mcp-documentation-server Web UI binds to all interfaces without authentication (CVE-2026-54504)
@andrea9293/mcp-documentation-server (npm) 1.13.0: the Web UI/API that starts automatically on port 3080 binds to all network interfaces (0.0.0.0) instead of localhost-only, and its document-management API endpoints require no authentication — any network-adjacent attacker can read, modify, or delete the server's documents. Fixed in 1.13.1.
- highMCPA-2026-0038auth-missing
NetLicensing-MCP HTTP mode uses the server-side NetLicensing API key for unauthenticated requests (CVE-2026-54446)
netlicensing-mcp (PyPI) through 0.1.5: in HTTP transport mode, ApiKeyMiddleware forwards requests that carry no client API key unconditionally, and the downstream HTTP client falls back to the server's own NetLicensing API key — unauthenticated remote callers act with the operator's full API privileges. Fixed in 0.1.6.
- highMCPA-2026-0037rce-vectors
LangBot authenticated RCE via STDIO MCP server configuration (CVE-2026-54449)
LangBot (PyPI: langbot) through 4.10.5: any authenticated user can achieve arbitrary command execution on the LangBot server by adding an 'STDIO' MCP server with an arbitrary command in the MCP Server Configuration — the command is passed to StdioServerParameters and executed on the host. No fixed release was available at publication.
- highMCPA-2026-0036auth-missing
meta-ads-mcp X-Pipeboard-Token header auth bypass reuses the operator Meta token (CVE-2026-54547)
meta-ads-mcp (PyPI) before 1.0.115: AuthInjectionMiddleware rejects HTTP MCP requests only when both auth_token and pipeboard_token are absent, and extract_token_from_headers() does not recognize the X-Pipeboard-Token header — an attacker sending that header with any value passes the auth gate and the server executes Meta Ads API calls with the operator's own Meta token. Fixed in 1.0.115.
- highMCPA-2026-0035ssrf
meta-ads-mcp SSRF in upload_ad_image via unrestricted image_url fetch (CVE-2026-54549)
meta-ads-mcp (PyPI) before 1.0.115: the upload_ad_image MCP tool passes an attacker-controlled image_url directly to httpx.AsyncClient(follow_redirects=True).get() with no scheme, host, or IP validation, letting a caller (or a prompt-injected agent) make the server fetch arbitrary internal URLs, including cloud metadata endpoints. Fixed in 1.0.115.
- highMCPA-2026-0034auth-missing
MCP Python SDK WebSocket server transport lacks Host/Origin validation (CVE-2026-59950)
The MCP Python SDK (PyPI: mcp) before 1.28.1: the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without any Host or Origin header validation — the TransportSecuritySettings mechanism used by the SSE and Streamable HTTP transports was not wired into it, enabling DNS-rebinding / cross-origin access to locally hosted servers. Fixed in 1.28.1.
- highMCPA-2026-0033auth-missing
MCP Python SDK HTTP transports serve session requests without verifying the authenticated principal (CVE-2026-52869)
The MCP Python SDK (PyPI: mcp) before 1.27.2: the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session regardless of bearer token. Fixed in 1.27.2.
- highMCPA-2026-0032auth-missing
MCP Python SDK experimental task handlers expose other clients’ tasks (CVE-2026-52870)
The MCP Python SDK (PyPI: mcp) 1.23.0 through 1.27.1: the default request handlers installed by the experimental tasks feature (server.experimental.enable_tasks()) did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and cancel tasks belonging to other clients. Fixed in 1.27.2.
- highMCPA-2026-0031path-traversal
mcp-atlassian arbitrary file read via confluence_upload_attachment path
mcp-atlassian (PyPI) before 0.22.0: confluence_upload_attachment passes file_path directly to open(file_path, 'rb') with no path validation. Any authenticated MCP client — or a prompt-injected agent — can read any file the server process can access and exfiltrate it to Confluence as an attachment. Fixed in 0.22.0.
- highMCPA-2026-0030path-traversal
mcp-atlassian arbitrary server-side file read via Jira attachment upload
mcp-atlassian (PyPI) before 0.22.0 passes the client-supplied file_path of the Jira attachment-upload tools directly to open() on the server's filesystem. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read arbitrary files the server process can access and exfiltrate them as Atlassian attachments. Fixed in 0.22.0.
- mediumMCPA-2026-0029ssrf
mcp-atlassian DNS-rebinding TOCTOU bypass of the SSRF fix
mcp-atlassian (PyPI) before 0.22.0 validates the attacker-controlled X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url header host once at middleware time (the CVE-2026-27826 fix), but the outbound request is later built with the raw hostname and re-resolves at connect time with no IP pinning. A DNS-rebinding name that returns a public IP during validation and an internal IP at connect time bypasses the SSRF guard. Fixed in 0.22.0.
- highMCPA-2026-0028ssrf
mcp-atlassian unauthenticated SSRF via X-Atlassian-*-Url headers (CVE-2026-27826)
mcp-atlassian (PyPI) before 0.17.0 lets an unauthenticated attacker who can reach the HTTP endpoint force the server to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying the custom X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers without an Authorization header. Fixed in 0.17.0 by validating the header-supplied URLs.
- highMCPA-2026-0027ssrf
Flowise SSRF protection bypass via IPv4-mapped IPv6 addresses (CVE-2026-69257)
Flowise 3.1.2 and earlier fail to normalize IPv4-mapped IPv6 addresses (e.g. ::ffff:169.254.169.254) before checking the SSRF deny list in httpSecurity.ts; an ipaddr.js kind mismatch silently skips all IPv4 CIDR deny rules for such addresses. An attacker controlling DNS (AAAA record to ::ffff:<target>) bypasses all SSRF protections and reaches internal services, cloud metadata endpoints, and localhost. Fixed in 3.1.3.
- criticalMCPA-2026-0026rce-vectors
Flowise CSV Agent remote code execution via Pyodide code injection (CVE-2026-69255)
Flowise 3.1.2 and earlier allow code injection through the CSV Agent: attacker-controlled input reaches the Pyodide Python execution environment and escapes it, achieving remote code execution on the host (root shell verified by the reporter). Affects the flowise and flowise-components npm packages. Fixed in 3.1.3.
- criticalMCPA-2026-0025rce-vectors
Flowise sandbox escape to remote code execution (CVE-2026-69253)
Flowise 3.1.2 and earlier ship a JavaScript sandbox (FlowiseAI/nodevm) that can be escaped by authenticated users supplying custom function/tool code, executing arbitrary code on the host (reported by elttam). Affects the flowise and flowise-components npm packages. Fixed in 3.1.3.
- mediumMCPA-2026-0024overprivileged
Dynatrace MCP Server DQL injection via parameters not documented as DQL (GHSA-pqh8-p93p-2rx7)
@dynatrace-oss/dynatrace-mcp-server before 2.1.1 interpolates caller-supplied parameters typed as identifiers or constrained shorthand (timeframes, Kubernetes UIDs) directly into DQL query strings in several read tools. Injected DQL pipeline stages and // comments bypass the tools' documented field-scope, time-window, and display caps — including the readOnlyHint: true contract MCP clients may use for auto-approval. Fixed in 2.1.1 (PR #562).
- mediumMCPA-2026-0023rce-vectors
Dynatrace MCP Server workflow template injection via create_workflow_for_notification (GHSA-xrmj-5g4g-8987)
@dynatrace-oss/dynatrace-mcp-server before 2.0.0 interpolates three caller-supplied parameters (teamName, problemType, channel) of the create_workflow_for_notification tool directly into a Dynatrace Workflow definition. Dynatrace Workflows evaluate Jinja2 {{ ... }} expressions in action inputs at runtime, so injected expressions (e.g. {{ event() }}) can exfiltrate event data to attacker-controlled destinations through a workflow that persists in the tenant after the MCP session ends. Fixed in 2.0.0 (PR #547).
- highMCPA-2026-0022auth-missing
Dynatrace MCP Server unauthenticated HTTP MCP tool invocation (GHSA-p7w7-4929-vpj5)
@dynatrace-oss/dynatrace-mcp-server 1.8.7 and earlier, when run in HTTP mode, exposes the MCP endpoint without any authentication: anyone who can reach the port can invoke every MCP tool with the server's configured Dynatrace credentials (reading monitoring data, executing DQL, creating workflows). Fixed in 2.0.0, which adds required authentication for HTTP transport (PR #536).
- mediumMCPA-2026-0021ssrf
HKUDS nanobot SSRF in the web_fetch tool via 3xx redirects (CVE-2026-49138)
HKUDS nanobot (PyPI: nanobot-ai) before 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool: a URL that passes initial validation can 3xx-redirect to a loopback or private-network address, and httpx's automatic redirect following fetches it, letting remote attackers reach internal hosts (e.g. cloud metadata endpoints) through the agent. Fixed in 0.2.1 (patch PR #3928).
- lowMCPA-2026-0020overprivileged
HKUDS nanobot improper access controls in MCP enabledTools scope handler (CVE-2026-19244)
HKUDS nanobot (PyPI: nanobot-ai) up to 0.2.1 has improper access controls in connect_mcp_servers (nanobot/agent/tools/mcp.py, MCP enabledTools scope handler): the configured enabledTools scope is not enforced correctly, so tools outside the intended scope remain reachable, remotely exploitable with a public exploit. Upgrading to 0.3.0 fixes the issue (patch PR #4436).
- mediumMCPA-2026-0019credential-leak
n8n-MCP incorrect authorization exposes default-scope workflow version backups in multi-tenant HTTP mode (CVE-2026-55608)
n8n-mcp before 2.57.4, in multi-tenant HTTP mode (ENABLE_MULTI_TENANT=true), lets an authenticated tenant reach the server's local default-scope workflow_versions backups under certain conditions instead of being confined to its own tenant scope — reading or deleting backups left from a prior single-tenant deployment or migration period, which may contain sensitive workflow logic and node configuration. Fixed in 2.57.4.
- criticalMCPA-2026-0018credential-leak
n8n-MCP cross-tenant access to workflow version backups in multi-tenant HTTP deployments (CVE-2026-54052)
n8n-mcp before 2.56.1 does not isolate its locally stored workflow version history per tenant in multi-tenant HTTP deployments (ENABLE_MULTI_TENANT=true): an authenticated tenant can read workflow version snapshots belonging to other tenants — including full node definitions with credential references and authorization headers — and can delete other tenants' stored backups. stdio and single-tenant HTTP deployments are not affected. Fixed in 2.56.1, which isolates stored history per instance and clears previously un-scoped backups.
- lowMCPA-2026-0017path-traversal
LudusMCP ludus_environment_guides_search path traversal via guide_name (CVE-2026-19046)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to path traversal: src/tools/ludusEnvironmentGuidesSearch.ts (component ludus_environment_guides_search) uses the attacker-influenced guide_name argument to build a filesystem path without sanitization, so a poisoned tool call can read files outside the guides directory. The maintainer was notified via a public issue but no fixed release exists as of 2026-08-06.
- mediumMCPA-2026-0016rce-vectors
LudusMCP ludus_cli_execute command injection via command/args arguments (CVE-2026-19047)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to command injection: executeArbitraryCommand/executeCommand in src/ludusMCP/cliWrapper.ts (component ludus_cli_execute) passes the attacker-influenced command/args arguments into a shell, so a poisoned tool call can execute arbitrary commands on the local host. The maintainer was notified via a public issue but no fixed release exists as of 2026-08-06.
- mediumMCPA-2026-0015rce-vectors
LudusMCP get_credential_from_user command injection via secret-dialog description (CVE-2026-19045)
LudusMCP (npm: ludus-mcp) up to and including 1.0.24 is vulnerable to command injection: SecretDialog.showSecretDialog in src/utils/secretDialog.ts (component get_credential_from_user) interpolates the attacker-influenced Description argument into a shell command, so a poisoned tool call or manipulated description can execute arbitrary commands on the local host. The maintainer was notified via a public issue but no fixed release exists as of 2026-08-06.
- criticalMCPA-2026-0014ssrf
Flyto2 Core 2026-07-30 batch: unauthenticated callback SSRF, secret leaks, and guard bypasses (CVE-2026-67424..67428)
Five vulnerabilities in flyto-core before 2.26.7, disclosed together on 2026-07-30: unauthenticated flyto-verification /run callback_url SSRF with internal runner-secret exfiltration (CVE-2026-67426, CVSS 9.3); guarded HTTP modules following redirects into internal address space (CVE-2026-67424); ${env.VAR} interpolation reading arbitrary environment secrets despite an env allowlist (CVE-2026-67427); multiple HTTP-family modules fetching client-controlled URLs without SSRF validation (CVE-2026-67428); and LLM/API keys leaking to an attacker-controlled base_url (CVE-2026-67425). All fixed in 2.26.7.
- highMCPA-2026-0013ssrf
Flyto2 Core SSRF guard bypass via IPv6 transition addresses (CVE-2026-55787)
flyto-core before 2.26.3 validates outbound URLs in validate_url_ssrf but does not account for IPv6 transition addressing (IPv4-mapped, 6to4, NAT64), so requests that appear to target public IPv6 addresses can be routed to internal IPv4 hosts, bypassing the SSRF guard. Fixed in 2.26.3.
- highMCPA-2026-0012rce-vectors
Flyto2 Core unauthenticated command execution via HTTP MCP execute_module (CVE-2026-55786)
flyto-core versions 2.26.2 before 2.26.4 expose an execute_module operation on the HTTP MCP surface without authentication: a caller who can reach the HTTP listener can invoke arbitrary Flyto modules, including ones that run shell commands, without any credential. Fixed in 2.26.4.
- mediumMCPA-2026-0011auth-missing
AWS Labs DocumentDB MCP Server read-only mode bypass via write-capable aggregation pipeline stages (CVE-2026-18954)
awslabs.documentdb-mcp-server before 1.0.12 enforces read-only mode incorrectly in its aggregation pipeline tool: an authenticated MCP client can include write-capable aggregation stages that bypass the read-only enforcement logic and perform inappropriate write operations on the connected DocumentDB database. Fixed in 1.0.12.
- criticalMCPA-2026-0010malicious-package
Malicious PyPI packages impersonating popular AI libraries as MCP servers (openai-mcp, langchain-core-mcp, tiktoken-mcp, instructor-mcp)
A June 2026 PyPI campaign published packages that impersonate popular AI libraries under MCP-server names: openai-mcp (impersonating the official OpenAI SDK's module structure), langchain-core-mcp (impersonating langchain-core), tiktoken-mcp (impersonating OpenAI's tiktoken), and instructor-mcp (typosquatting instructor). Flagged as malware by Amazon Inspector via OSV (MAL-2026-5317/5318/5320/5326). These names read like plausible MCP bridges for well-known libraries and are exactly what an AI assistant might suggest launching via uvx; none are published by the legitimate upstream projects. Treat every version as malicious.
- criticalMCPA-2026-0009malicious-package
Malicious npm packages squatting official MCP reference server names (mcp-server-fetch et al.)
A June 2026 campaign published ten unscoped npm packages squatting the names of official MCP reference servers (mcp-server-fetch, mcp-server-git, mcp-server-github, mcp-server-figma, mcp-server-notion, mcp-server-postgres, mcp-server-redis, mcp-server-sentry, mcp-server-sequential-thinking, mcp-server-supabase). Each declares a postinstall hook and uses the same file as main/bin, so the payload runs on npm install, require(), and npx invocation alike, exfiltrating host and environment data to a hardcoded workers.dev endpoint. AI coding agents and MCP client configs commonly launch these exact names via `npx mcp-server-*`; the legitimate reference servers live under the @modelcontextprotocol scope (e.g. @modelcontextprotocol/server-github) or, for fetch/git, on PyPI. Treat every version of the unscoped npm names as malicious.
- criticalMCPA-2026-0008path-traversal
Flyto2 Core arbitrary file write via image.download output_dir bypass (CVE-2026-67429)
flyto-core (a PyPI MCP-native AI agent execution engine) versions before 2.26.7 let callers of the image.download module set both output_path and the output_dir base it is validated against, so the path-confinement check is meaningless: attacker-controlled HTTP response bytes can be written to any absolute path the process can write. Rated CVSS 10.0 (scope-changed integrity/availability impact). Fixed in 2.26.7.
- mediumMCPA-2026-0007path-traversal
gemini-bridge arbitrary local file read via consult_gemini_with_files inline mode (CVE-2026-54785)
gemini-bridge (a PyPI MCP server bridging Claude Code to the Gemini CLI) versions >= 1.0.0 and < 1.3.1 read any file path supplied in the `files` argument of `consult_gemini_with_files` in inline mode without confining it to the working `directory`, then forwarded the contents to the Gemini CLI. An MCP client — or an LLM prompt-injected into calling the tool — can read any file the server process can access (SSH keys, cloud credentials, .env) and have it disclosed via the tool response and sent to Google. Fixed in 1.3.1.
- highMCPA-2026-0006rce-vectors
Flowise MCP environment-variable blocklist bypass via npm_config_yes (unauthenticated RCE, CVE-2026-69263)
Flowise <= 3.1.2 shipped a mitigation for CVE-2025-8943 that blocks the -y/--yes flags on npx-launched MCP servers, but its environment-variable check denies only four names by exact match. npm reads configuration from npm_config_* environment variables, so setting npm_config_yes=true reproduces --yes: npx auto-installs and executes an attacker-named package, fully bypassing the mitigation even with the MCP security check enabled. Fixed in flowise / flowise-components 3.1.3.
- criticalMCPA-2026-0005malicious-package
mcp-search-server (PyPI) is a malicious package
The PyPI package mcp-search-server contained malicious code in every published release (1.0.0, 2.0.0, 2.0.1). Identified by the OpenSSF malicious-packages project and published as GHSA-3rhm-6v7p-whrg / OSV MAL-2026-11198; documented as part of a July 2026 PyPI campaign. Machines that installed or launched it (e.g. via `uvx mcp-search-server`) should be treated as compromised: remove the package and rotate secrets.
- criticalMCPA-2026-0004malicious-package
ray-mcp-server 0.2.1 shipped malicious code (Hades/Shai-Hulud PyPI campaign)
PyPI package ray-mcp-server version 0.2.1 contained malicious code delivered through a setup.pth payload, part of the Hades campaign hitting PyPI packages. Published as PYSEC-2026-1074 / OSV MAL-2026-5325. Only 0.2.1 is listed as affected; installations pinned to other versions should still verify their environment, and machines that installed 0.2.1 (e.g. via `uvx ray-mcp-server`) should rotate secrets.
- criticalMCPA-2026-0003malicious-package
explorhub-mcp-server is a malicious npm package
The npm package explorhub-mcp-server contains embedded malicious code (CWE-506); every published version is affected. Identified by the OpenSSF malicious-packages project and published as GHSA-2qjx-pmc9-2jrj / OSV MAL-2026-4312. Any machine that installed or launched it (e.g. via `npx explorhub-mcp-server` in an MCP client config) should be treated as compromised: remove the package and rotate secrets.
- highMCPA-2026-0002ssrf
n8n-mcp path traversal, redirect-following SSRF, and telemetry payload exposure
n8n-mcp before 2.50.1 contained three issues affecting deployments using the n8n API integration: caller-supplied identifiers used unvalidated as URL path segments (path traversal redirecting API-key-bearing requests to other same-origin endpoints, bypassing DISABLED_TOOLS), validated trigger URLs following redirects to otherwise-rejected hosts (non-blind SSRF), and mutation telemetry uploading unredacted operation payloads that can include bearer tokens and webhook secrets. CVSS 8.3.
- highMCPA-2026-0001ssrf
Azure MCP Server server-side request forgery allows privilege elevation (CVE-2026-26118)
Server-Side Request Forgery (SSRF) in Microsoft's Azure MCP Server allows an authorized attacker to elevate privileges over a network. Affects the npm, NuGet and PyPI distributions of Azure MCP Server Tools.
- criticalMCPA-2025-0014malicious-package
Malicious npm package mcp-server-everything squats the MCP reference "everything" server
The unscoped npm package mcp-server-everything (observed at 2.0.0, September 2025) is malicious and squats the name of the official MCP reference "everything" test server, which lives under the @modelcontextprotocol scope as @modelcontextprotocol/server-everything. OSV/GHSA flag every version of the unscoped name as malware (OSV MAL-2025-46986, GHSA-6j44-frpv-rvv9). MCP client configs and docs commonly launch the reference server via npx, so a missing scope prefix installs the malicious package instead. Treat every version of the unscoped npm name as malicious and use @modelcontextprotocol/server-everything.
- mediumMCPA-2025-0013ssrf
mcp-fetch-server SSRF via private-IP validation bypass (CVE-2025-65513)
fetch-mcp (npm: mcp-fetch-server) versions through 1.0.2 fail to properly validate private IP addresses in their is_ip_private() check, allowing server-side request forgery that reaches internal network resources through the server's URL-fetching tools.
- criticalMCPA-2025-0012malicious-package
@lanyer640/mcp-runcommand-server npm package backdoored with dual reverse shells
The npm MCP server @lanyer640/mcp-runcommand-server, first published as a legitimate run-command tool, was weaponized in version 1.0.6: a preinstall hook opens a reverse shell to an attacker-controlled server (45.115.38.27:2333) during `npm install`/`npx`, and a second persistent reverse shell activates whenever the MCP server runs. The functional tool behavior masked the backdoor.
- highMCPA-2025-0011rce-vectors
figma-developer-mcp (Framelink Figma MCP) command injection in get_figma_data (CVE-2025-53967)
figma-developer-mcp before 0.6.3 passes unsanitized input (e.g. the `fileKey` argument) into a shell `curl` invocation inside its fetchWithRetry fallback, allowing an attacker to inject arbitrary operating system commands via shell metacharacters. Exploitable by a crafted request with network access to the MCP interface, or indirectly via prompt injection.
- criticalMCPA-2025-0010rce-vectors
adb-mcp command injection in inspect_ui tool (CVE-2025-59834)
adb-mcp through 0.1.0 builds adb shell command lines from unvalidated tool input (e.g. the `device` argument) and executes them via Node.js `child_process.exec`, allowing shell metacharacter injection and remote code execution on the host running the server. No fixed release was available at publication.
- criticalMCPA-2025-0009rce-vectors
@akoskm/create-mcp-server-stdio command injection via exec in which-app-on-port tool (CVE-2025-54994)
The MCP server scaffold @akoskm/create-mcp-server-stdio before 0.0.13 exposes a `which-app-on-port` tool that concatenates untrusted input into Node.js `child_process.exec`, allowing command injection and remote code execution under the server process's privileges.
- highMCPA-2025-0008rce-vectors
mcp-package-docs command injection in several tools (CVE-2025-54073)
mcp-package-docs versions through 0.1.27 pass unsanitized tool input into `child_process.exec`, enabling shell metacharacter injection and remote code execution under the server process's privileges. Fixed in 0.1.28; the package has since been deprecated on npm and the repository archived.
- highMCPA-2025-0007rce-vectors
mcp-server-kubernetes command injection in several kubectl tools (CVE-2025-53355)
mcp-server-kubernetes before 2.5.0 builds kubectl command lines from unvalidated tool input and executes them with `child_process.execSync`, enabling shell metacharacter injection in tools such as `kubectl_scale`, `kubectl_patch`, and `explain_resource`. Indirect prompt injection via pod logs can chain into arbitrary command execution on the host running the server.
- highMCPA-2025-0006rce-vectors
@cyanheads/git-mcp-server command injection in several git tools (CVE-2025-53107)
git-mcp-server versions through 2.1.4 pass unsanitized tool input (e.g. branch names, file arguments) into `child_process.exec`, allowing shell metacharacter injection in tools such as `git_init` and `git_add`. Indirect prompt injection via crafted git commit messages can chain into arbitrary command execution on the host running the server.
- highMCPA-2025-0005path-traversal
@modelcontextprotocol/server-filesystem symlink bypass enables full filesystem access (CVE-2025-53109)
A crafted symlink inside an allowed directory of the reference Filesystem MCP server could point anywhere on the filesystem and bypass access enforcement, giving attackers read/write access to critical files outside the sandbox and a path to code execution.
- highMCPA-2025-0004path-traversal
@modelcontextprotocol/server-filesystem path validation bypass via colliding path prefix (CVE-2025-53110)
The reference Filesystem MCP server used naive prefix matching to enforce its allowed-directories sandbox: any path that merely begins with an approved directory string (e.g. /private/tmp/allowed_dir_evil) bypassed the filter, allowing unrestricted listing, reading and writing outside the intended sandbox.
- criticalMCPA-2025-0003auth-missing
MCP Inspector proxy allows unauthenticated remote code execution (CVE-2025-49596)
Versions of Anthropic's MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests (including from malicious websites via CSRF) to launch arbitrary MCP commands over stdio on the developer's machine.
- criticalMCPA-2025-0002malicious-package
postmark-mcp npm package backdoored to exfiltrate emails via hidden BCC
The npm package `postmark-mcp`, an unofficial copy of Postmark's MCP server for sending email, turned malicious in version 1.0.16: a single added line silently BCC'd every outgoing email to an attacker-controlled address at giftshop[.]club. The package was clean through 1.0.15, making this a textbook MCP rug-pull supply-chain attack.
- criticalMCPA-2025-0001rce-vectors
mcp-remote OS command injection via untrusted MCP server (CVE-2025-6514)
mcp-remote, the widely used npm proxy for connecting local MCP clients to remote MCP servers, is exposed to OS command injection when connecting to untrusted MCP servers. A malicious server can achieve remote code execution on the client machine via crafted input in the authorization_endpoint response URL during the OAuth flow.