MCP Advisory Database
A public, structured database of verified security advisories affecting MCP servers, clients, and tooling. Every entry cites authoritative sources. Query it via theAdvisory API, subscribe viaRSS or JSON Feed, orcontribute a new advisory.
- highMCPA-2026-0002ssrf
n8n-mcp path traversal, redirect-following SSRF, and telemetry payload exposure
n8n-mcp before 2.50.1 contained three issues affecting deployments using the n8n API integration: caller-supplied identifiers used unvalidated as URL path segments (path traversal redirecting API-key-bearing requests to other same-origin endpoints, bypassing DISABLED_TOOLS), validated trigger URLs following redirects to otherwise-rejected hosts (non-blind SSRF), and mutation telemetry uploading unredacted operation payloads that can include bearer tokens and webhook secrets. CVSS 8.3.
- highMCPA-2026-0001ssrf
Azure MCP Server server-side request forgery allows privilege elevation (CVE-2026-26118)
Server-Side Request Forgery (SSRF) in Microsoft's Azure MCP Server allows an authorized attacker to elevate privileges over a network. Affects the npm, NuGet and PyPI distributions of Azure MCP Server Tools.
- mediumMCPA-2025-0013ssrf
mcp-fetch-server SSRF via private-IP validation bypass (CVE-2025-65513)
fetch-mcp (npm: mcp-fetch-server) versions through 1.0.2 fail to properly validate private IP addresses in their is_ip_private() check, allowing server-side request forgery that reaches internal network resources through the server's URL-fetching tools.
- criticalMCPA-2025-0012malicious-package
@lanyer640/mcp-runcommand-server npm package backdoored with dual reverse shells
The npm MCP server @lanyer640/mcp-runcommand-server, first published as a legitimate run-command tool, was weaponized in version 1.0.6: a preinstall hook opens a reverse shell to an attacker-controlled server (45.115.38.27:2333) during `npm install`/`npx`, and a second persistent reverse shell activates whenever the MCP server runs. The functional tool behavior masked the backdoor.
- highMCPA-2025-0011rce-vectors
figma-developer-mcp (Framelink Figma MCP) command injection in get_figma_data (CVE-2025-53967)
figma-developer-mcp before 0.6.3 passes unsanitized input (e.g. the `fileKey` argument) into a shell `curl` invocation inside its fetchWithRetry fallback, allowing an attacker to inject arbitrary operating system commands via shell metacharacters. Exploitable by a crafted request with network access to the MCP interface, or indirectly via prompt injection.
- criticalMCPA-2025-0010rce-vectors
adb-mcp command injection in inspect_ui tool (CVE-2025-59834)
adb-mcp through 0.1.0 builds adb shell command lines from unvalidated tool input (e.g. the `device` argument) and executes them via Node.js `child_process.exec`, allowing shell metacharacter injection and remote code execution on the host running the server. No fixed release was available at publication.
- criticalMCPA-2025-0009rce-vectors
@akoskm/create-mcp-server-stdio command injection via exec in which-app-on-port tool (CVE-2025-54994)
The MCP server scaffold @akoskm/create-mcp-server-stdio before 0.0.13 exposes a `which-app-on-port` tool that concatenates untrusted input into Node.js `child_process.exec`, allowing command injection and remote code execution under the server process's privileges.
- highMCPA-2025-0008rce-vectors
mcp-package-docs command injection in several tools (CVE-2025-54073)
mcp-package-docs versions through 0.1.27 pass unsanitized tool input into `child_process.exec`, enabling shell metacharacter injection and remote code execution under the server process's privileges. Fixed in 0.1.28; the package has since been deprecated on npm and the repository archived.
- highMCPA-2025-0007rce-vectors
mcp-server-kubernetes command injection in several kubectl tools (CVE-2025-53355)
mcp-server-kubernetes before 2.5.0 builds kubectl command lines from unvalidated tool input and executes them with `child_process.execSync`, enabling shell metacharacter injection in tools such as `kubectl_scale`, `kubectl_patch`, and `explain_resource`. Indirect prompt injection via pod logs can chain into arbitrary command execution on the host running the server.
- highMCPA-2025-0006rce-vectors
@cyanheads/git-mcp-server command injection in several git tools (CVE-2025-53107)
git-mcp-server versions through 2.1.4 pass unsanitized tool input (e.g. branch names, file arguments) into `child_process.exec`, allowing shell metacharacter injection in tools such as `git_init` and `git_add`. Indirect prompt injection via crafted git commit messages can chain into arbitrary command execution on the host running the server.
- highMCPA-2025-0005path-traversal
@modelcontextprotocol/server-filesystem symlink bypass enables full filesystem access (CVE-2025-53109)
A crafted symlink inside an allowed directory of the reference Filesystem MCP server could point anywhere on the filesystem and bypass access enforcement, giving attackers read/write access to critical files outside the sandbox and a path to code execution.
- highMCPA-2025-0004path-traversal
@modelcontextprotocol/server-filesystem path validation bypass via colliding path prefix (CVE-2025-53110)
The reference Filesystem MCP server used naive prefix matching to enforce its allowed-directories sandbox: any path that merely begins with an approved directory string (e.g. /private/tmp/allowed_dir_evil) bypassed the filter, allowing unrestricted listing, reading and writing outside the intended sandbox.
- criticalMCPA-2025-0003auth-missing
MCP Inspector proxy allows unauthenticated remote code execution (CVE-2025-49596)
Versions of Anthropic's MCP Inspector below 0.14.1 are vulnerable to remote code execution due to lack of authentication between the Inspector client and proxy, allowing unauthenticated requests (including from malicious websites via CSRF) to launch arbitrary MCP commands over stdio on the developer's machine.
- criticalMCPA-2025-0002malicious-package
postmark-mcp npm package backdoored to exfiltrate emails via hidden BCC
The npm package `postmark-mcp`, an unofficial copy of Postmark's MCP server for sending email, turned malicious in version 1.0.16: a single added line silently BCC'd every outgoing email to an attacker-controlled address at giftshop[.]club. The package was clean through 1.0.15, making this a textbook MCP rug-pull supply-chain attack.
- criticalMCPA-2025-0001rce-vectors
mcp-remote OS command injection via untrusted MCP server (CVE-2025-6514)
mcp-remote, the widely used npm proxy for connecting local MCP clients to remote MCP servers, is exposed to OS command injection when connecting to untrusted MCP servers. A malicious server can achieve remote code execution on the client machine via crafted input in the authorization_endpoint response URL during the OAuth flow.