mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6
影響: npm:mcp-sanitizer < 1.4.0 → 1.4.0
URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 Summary mcp-sanitizer v1.3.3 fails to block Server-Side Request Forgery (SSRF) targets when a localhost URL includes an explicit port (e.g., http://localhost:8080/) or when an IPv6 loopback/link-local address is expressed in bracketed notation (e.g., http://[::1]:8080/, http://[fe80::1]:8080/). Because the library is explicitly designed to gate MCP tool parameters such as web_fetch and web_scraper befor…
在 X 上接收快讯漏洞利用、重大泄露和故障，附应对措施。
关注 @vulnpulse_app| 来源 | GitHub Advisory Database |
|---|---|
| 获取时间 | 2026/10/29 09:48 |
| 数据 | Markdown JSON |
2026/10/29 04:51，GitHub Advisory Database 发布了“mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。