ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
影響: npm:@aborruso/ckan-mcp-server < 0.4.112 → 0.4.112
The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction. Affected code src/resources/d…
| CVE | CVE-2026-76894 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/22 01:17 |
| データ | Markdown JSON |
2026/10/17 04:23、GitHub Advisory Databaseが「ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「注意」(low) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-76894。