{"id":"CVE-2026-63651","kind":"vulnerability","aliases":["CVE-2026-63651"],"related":[],"title":"LiveDocs: prompt injection can make the docs agent fetch internal URLs","description":"LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetch_docs and introspect (kinds openapi/graphql, and resolve_source's docs_url) pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A prompt-injection payload embedded in fetched documentation can steer the model to call fetch_docs against internal or metadata endpoints and stream the response back into the conversation. This issue has been patched in version 0.7.0.","summary":"LiveDocs, a documentation server for AI agents, passes any client-supplied URL straight to an HTTP request with no scheme or host allowlist, and follows redirects unconditionally. A prompt-injection payload in fetched documentation can make the model call fetch_docs against internal or cloud metadata endpoints and return the response into the conversation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","livedocs","mcp","self-hosted"],"not_affected_if":["version-0.7.0-or-later"],"how_to_check":"- Check the installed LiveDocs version; versions before `0.7.0` are affected.\n- Look for `fetch_docs`, `introspect`, or `resolve_source` in your MCP or agent configuration to confirm it is in use.","fix":"- LiveDocs: move to `0.7.0` or later.","status":"open","published_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","triaged_at":"2026-11-10T17:23:46+00:00","updated_at":"2026-11-10T17:23:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-10T17:23:46Z","model":"claude-haiku-5-5","output":{"fix":"- LiveDocs: move to `0.7.0` or later.","reach":"network","title":"LiveDocs: prompt injection can make the docs agent fetch internal URLs","impact":"high","summary":"LiveDocs, a documentation server for AI agents, passes any client-supplied URL straight to an HTTP request with no scheme or host allowlist, and follows redirects unconditionally. A prompt-injection payload in fetched documentation can make the model call fetch_docs against internal or cloud metadata endpoints and return the response into the conversation.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","mcp","livedocs","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"model reads internal service responses and cloud metadata credentials","analyst_note":"","how_to_check":"- Check the installed LiveDocs version; versions before `0.7.0` are affected.\n- Look for `fetch_docs`, `introspect`, or `resolve_source` in your MCP or agent configuration to confirm it is in use.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-0.7.0-or-later"],"who_is_affected":"Teams running LiveDocs before 0.7.0 as an MCP or agent documentation tool, especially on hosts that can reach internal services or cloud metadata endpoints. Exposure depends on the agent fetching untrusted documentation and on what the host network can reach; teams on 0.7.0 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4648,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-63651':14A,17A '0.7.0':96C,166C 'agent':8A,32B,92C 'ai':19B,31B,91C 'ai-tool':18B 'allowlist':49B,123C 'back':155C 'call':66B,143C 'client':36B,112C 'client-suppli':35B,111C 'cloud':72B 'convers':81B,158C 'cve':12A,15A 'doc':7A,68B,98C,107C,145C 'document':28B,61B,89C,137C 'embed':134C 'endpoint':74B,150C 'fetch':9A,60B,67B,97C,136C,144C 'first':88C 'follow':51B,127C 'host':25B,48B,122C 'http':42B 'inject':3A,57B,132C 'intern':10A,70B,147C 'introspect':100C 'issu':160C 'kind':101C 'livedoc':1A,21B,26B,82C 'make':5A,63B 'mcp':22B 'metadata':73B,149C 'model':65B,141C 'openapi/graphql':102C 'pass':33B,109C 'patch':163C 'payload':58B,133C 'primari':86C 'primary-source-first':85C 'prior':93C 'prompt':2A,56B,131C 'prompt-inject':55B,130C 'redirect':52B,125C 'request':43B 'resolv':104C 'respons':78B,154C 'return':76B 'scheme':46B,120C 'self':24B 'self-host':23B 'server':29B 'sourc':87C,105C 'steer':139C 'straight':39B,115C 'stream':152C 'suppli':37B,113C 'tool':20B 'uncondit':53B,128C 'url':11A,38B,108C,114C 'urlsess':117C 'version':95C,165C","nicknames":[],"mitigations":[],"who_affected":"Teams running LiveDocs before 0.7.0 as an MCP or agent documentation tool, especially on hosts that can reach internal services or cloud metadata endpoints. Exposure depends on the agent fetching untrusted documentation and on what the host network can reach; teams on 0.7.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","livedocs","mcp","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-63651':14A,17A 'agent':8A 'cve':12A,15A 'doc':7A 'fetch':9A 'inject':3A 'intern':10A 'livedoc':1A 'make':5A 'prompt':2A 'url':11A","search_b":"'agent':32B 'ai':19B,31B 'ai-tool':18B 'allowlist':49B 'call':66B 'client':36B 'client-suppli':35B 'cloud':72B 'convers':81B 'doc':68B 'document':28B,61B 'endpoint':74B 'fetch':60B,67B 'follow':51B 'host':25B,48B 'http':42B 'inject':57B 'intern':70B 'livedoc':21B,26B 'make':63B 'mcp':22B 'metadata':73B 'model':65B 'pass':33B 'payload':58B 'prompt':56B 'prompt-inject':55B 'redirect':52B 'request':43B 'respons':78B 'return':76B 'scheme':46B 'self':24B 'self-host':23B 'server':29B 'straight':39B 'suppli':37B 'tool':20B 'uncondit':53B 'url':38B","search_c":"'0.7.0':96C,166C 'agent':92C 'ai':91C 'allowlist':123C 'back':155C 'call':143C 'client':112C 'client-suppli':111C 'convers':158C 'doc':98C,107C,145C 'document':89C,137C 'embed':134C 'endpoint':150C 'fetch':97C,136C,144C 'first':88C 'follow':127C 'host':122C 'inject':132C 'intern':147C 'introspect':100C 'issu':160C 'kind':101C 'livedoc':82C 'metadata':149C 'model':141C 'openapi/graphql':102C 'pass':109C 'patch':163C 'payload':133C 'primari':86C 'primary-source-first':85C 'prior':93C 'prompt':131C 'prompt-inject':130C 'redirect':125C 'resolv':104C 'respons':154C 'scheme':120C 'sourc':87C,105C 'steer':139C 'straight':115C 'stream':152C 'suppli':113C 'uncondit':128C 'url':108C,114C 'urlsess':117C 'version':95C,165C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-01T23:46:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63651","severity":null,"published_at":"2026-11-10T17:17:46+00:00","modified_at":"2026-11-10T17:17:46+00:00","first_seen_at":"2026-11-10T17:22:44+00:00","fetched_at":"2026-11-10T17:22:44+00:00","note":null}],"documents":[{"id":116532,"url":"https://github.com/PsychQuant/livedocs/releases/tag/v0.7.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":116533,"url":"https://github.com/PsychQuant/livedocs/security/advisories/GHSA-xf4p-x7v8-3x4p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T23:46:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}