{"id":"MAL-2026-19204","kind":"package","aliases":["MAL-2026-19204"],"related":[],"title":"Malicious code in my-mcp-server-driving-license-ocr (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6f389c95da49d7d8358b52ea58ed6dcba6ee9cc9f1d441dfab7a9a3eb1b0989e)\nThe package exposes an MCP tool `analyze_image` advertised as driving-license OCR. The tool accepts caller-supplied image URLs or base64 image bytes and POSTs them to the hardcoded endpoint http://42.193.222.35:8000/ocr_pic over plaintext HTTP. The code reads `MY_API_URL` from the environment but then unconditionally reassigns `API_URL` to the hardcoded bare IP, so any caller-provided configuration is silently discarded and the destination cannot be redirected. The destination is a bare IP with no publisher or vendor disclosure, is reached without TLS, and receives personally identifiable document images (driving licenses) that callers submit to what they believe is an OCR utility.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"my-mcp-server-driving-license-ocr","fixed":[],"affected":"= 0.1.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T00:49:20+00:00","first_seen_at":"2026-11-13T02:11:13+00:00","triaged_at":"2026-11-13T02:13:11+00:00","updated_at":"2026-11-13T02:13:11+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19204':14A,17A '-2026':13A,16A '42.193.222.35':74C '6f389c95da49d7d8358b52ea58ed6dcba6ee9cc9f1d441dfab7a9a3eb1b0989e':40C '8000/ocr_pic':75C 'accept':57C 'advertis':49C 'amazon':38C 'amazon-inspector':37C 'analyz':47C 'api':83C,92C 'bare':97C,118C 'base64':64C 'believ':144C 'byte':66C 'caller':59C,102C,139C 'caller-provid':101C 'caller-suppli':58C 'cannot':111C 'code':2A,80C 'configur':104C 'destin':110C,115C 'detail':29C 'discard':107C 'disclosur':125C 'document':134C 'drive':8A,52C,136C 'driving':22A 'driving-licens':51C 'edit':32C 'endpoint':73C 'environ':87C 'expos':43C 'hardcod':72C,96C 'http':78C 'identifi':133C 'imag':48C,61C,65C,135C 'inspector':39C 'ip':98C,119C 'licens':9A,53C,137C 'license':23A 'line':35C 'mal':12A,15A 'malici':1A,25B 'mcp':6A,20A,45C 'my':19A 'my-mcp-server-driving-license-ocr':4A,18A 'ocr':10A,24A,54C,147C 'packag':26B,42C 'per':27C 'person':132C 'plaintext':77C 'post':68C 'provid':103C 'publish':122C 'pypi':11A 'reach':127C 'read':81C 'reassign':91C 'receiv':131C 'redirect':113C 'server':7A,21A 'silent':106C 'sourc':28C,36C 'submit':140C 'suppli':60C 'tls':129C 'tool':46C,56C 'uncondit':90C 'url':62C,84C,93C 'util':148C 'vendor':124C 'without':128C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["mymcpserverdrivinglicenseocr"],"ptokens":["driving","license","mcp","my","ocr","server"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19204':14A,17A '-2026':13A,16A 'code':2A 'drive':8A 'driving':22A 'licens':9A 'license':23A 'mal':12A,15A 'malici':1A 'mcp':6A,20A 'my':19A 'my-mcp-server-driving-license-ocr':4A,18A 'ocr':10A,24A 'pypi':11A 'server':7A,21A","search_b":"'malici':25B 'packag':26B","search_c":"'42.193.222.35':74C '6f389c95da49d7d8358b52ea58ed6dcba6ee9cc9f1d441dfab7a9a3eb1b0989e':40C '8000/ocr_pic':75C 'accept':57C 'advertis':49C 'amazon':38C 'amazon-inspector':37C 'analyz':47C 'api':83C,92C 'bare':97C,118C 'base64':64C 'believ':144C 'byte':66C 'caller':59C,102C,139C 'caller-provid':101C 'caller-suppli':58C 'cannot':111C 'code':80C 'configur':104C 'destin':110C,115C 'detail':29C 'discard':107C 'disclosur':125C 'document':134C 'drive':52C,136C 'driving-licens':51C 'edit':32C 'endpoint':73C 'environ':87C 'expos':43C 'hardcod':72C,96C 'http':78C 'identifi':133C 'imag':48C,61C,65C,135C 'inspector':39C 'ip':98C,119C 'licens':53C,137C 'line':35C 'mcp':45C 'ocr':54C,147C 'packag':42C 'per':27C 'person':132C 'plaintext':77C 'post':68C 'provid':103C 'publish':122C 'reach':127C 'read':81C 'reassign':91C 'receiv':131C 'redirect':113C 'silent':106C 'sourc':28C,36C 'submit':140C 'suppli':60C 'tls':129C 'tool':46C,56C 'uncondit':90C 'url':62C,84C,93C 'util':148C 'vendor':124C 'without':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T00:49:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19204","url":"https://osv.dev/vulnerability/MAL-2026-19204","severity":"critical","published_at":"2026-11-13T00:49:20+00:00","modified_at":"2026-11-13T01:15:03+00:00","first_seen_at":"2026-11-13T02:11:13+00:00","fetched_at":"2026-11-13T02:11:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}