CVE-2026-63651 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
LiveDocs, a documentation server for AI agents, passes any client-supplied URL straight to an HTTP request with no scheme or host allowlist, and follows redirects unconditionally. A prompt-injection payload in fetched documentation can make the model call fetch_docs against internal or cloud metadata endpoints and return the response into the conversation.
first public Jul 1, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running LiveDocs before 0.7.0 as an MCP or agent documentation tool, especially on hosts that can reach internal services or cloud metadata endpoints. Exposure depends on the agent fetching untrusted documentation and on what the host network can reach; teams on 0.7.0 or later are not affected.
Not affected if version-0.7.0-or-later
Who cares livedocs, mcp, self-hosted
0.7.0 are affected.fetch_docs, introspect, or resolve_source in your MCP or agent configuration to confirm it is in use.0.7.0 or later.LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect (kinds openapi/graphql, and resolve_source's docs_url) pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A prompt-injection payload embedded in fetched documentation can steer the model to call fetch_docs against internal or metadata endpoints and stream the response back into the conversation. This issue has been patched in version 0.7.0.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.