MCPA-2026-0089
lowssrfCVSS 5.3
mcp-google-search read_webpage server-side request forgery (CVE-2026-19337)
@adenot/mcp-google-search (npm): the read_webpage MCP tool passes the caller-controlled url argument directly to axios.get in src/index.ts, validating only that it is a string, so a prompt-injected or malicious tool call can make the server request loopback, private-network, or cloud-metadata URLs from the server's network position (private-network SSRF). The upstream issue is open and no fixed release is published (npm latest is 0.3.1), so this is recorded as last_affected 0.3.1.
Affected packages
| Ecosystem | Package | Affected versions |
|---|---|---|
| npm | @adenot/mcp-google-search | >= 0, <= 0.3.1 |
Identifiers
CVE-2026-19337GHSA-jg2j-2qmx-58vqCWE-918
References
- advisory https://github.com/advisories/GHSA-jg2j-2qmx-58vq
- web https://nvd.nist.gov/vuln/detail/CVE-2026-19337
- web https://github.com/adenot/mcp-google-search/issues/11
Timeline
- Published: 2026-08-09