https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 16:07:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318618 EUVD-2026-318618 https://cve.radiocsirt.org/vuln/euvd-2026-318618 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42260 <p>Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.</p> <p>Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42260 https://cve.radiocsirt.org/vuln/ghsa-v228-72c7-fx8j <p><strong>Affected:</strong> npm: open-websearch</p> <p>### Summary `src/utils/urlSafety.ts` exposes `isPublicHttpUrl` / `assertPublicHttpUrl`, used to gate the MCP `fetchWebContent` tool against private-network targets. The check has two defects that together allow **non-blind SSRF with the response body returned to the caller**:</p> <p>1. **Bracketed IPv6 literals are never recognized.** Node&#39;s WHATWG `URL.hostname` keeps the surrounding `[…]` for IPv6 literals. `isIP(&#34;[::1]&#34;)` returns 0 (not 6), so neither `isPrivateIpv4` nor `isPrivateIpv6` is ever called on an IPv6 literal input — including `[::1]` itself, and including every IPv4-mapped form such as `[::ffff:7f00:1]` (= 127.0.0.1 via the IPv4 stack). 2. **No DNS resolution.** `isPrivateOrLocalHostname` only inspects the literal `hostname` string. It never resolves the host to an IP. Any attacker-controlled hostname whose DNS record points at 127.0.0.1 (or any RFC1918 / link-local address) passes the check unchanged, and `axios` then performs its own resolution and connects to the private address.</p> <p>The `isPrivateIpv6` implementation also has the hex bypass (it would miss `::ffff:7f00:1` even if reached) but defect (1) makes every bracketed IPv6 literal slip past before that branch is even entered.</p> <p>The `fetchWebContent` tool returns the response body (`JSON.stringify(result)`) to the MCP caller, so the SSRF is non-blind.</p> <p>### Details &lt;!-- obsidian --&gt;&lt;p&gt;&lt;strong&gt;Vulnerable function&lt;/strong&gt; — &lt;code&gt;src/utils/urlSafety.ts:95-119&lt;/code&gt;:&lt;/p&gt; &lt;pre&gt;&lt;code class=&#34;language-ts&#34;&gt;export func…</p> <p><strong>Affected:</strong> npm: open-websearch</p> <p>### Summary `src/utils/urlSafety.ts` exposes `isPublicHttpUrl` / `assertPublicHttpUrl`, used to gate the MCP `fetchWebContent` tool against private-network targets. The check has two defects that together allow **non-blind SSRF with the response body returned to the caller**:</p> <p>1. **Bracketed IPv6 literals are never recognized.** Node&#39;s WHATWG `URL.hostname` keeps the surrounding `[…]` for IPv6 literals. `isIP(&#34;[::1]&#34;)` returns 0 (not 6), so neither `isPrivateIpv4` nor `isPrivateIpv6` is ever called on an IPv6 literal input — including `[::1]` itself, and including every IPv4-mapped form such as `[::ffff:7f00:1]` (= 127.0.0.1 via the IPv4 stack). 2. **No DNS resolution.** `isPrivateOrLocalHostname` only inspects the literal `hostname` string. It never resolves the host to an IP. Any attacker-controlled hostname whose DNS record points at 127.0.0.1 (or any RFC1918 / link-local address) passes the check unchanged, and `axios` then performs its own resolution and connects to the private address.</p> <p>The `isPrivateIpv6` implementation also has the hex bypass (it would miss `::ffff:7f00:1` even if reached) but defect (1) makes every bracketed IPv6 literal slip past before that branch is even entered.</p> <p>The `fetchWebContent` tool returns the response body (`JSON.stringify(result)`) to the MCP caller, so the SSRF is non-blind.</p> <p>### Details &lt;!-- obsidian --&gt;&lt;p&gt;&lt;strong&gt;Vulnerable function&lt;/strong&gt; — &lt;code&gt;src/utils/urlSafety.ts:95-119&lt;/code&gt;:&lt;/p&gt; &lt;pre&gt;&lt;code class=&#34;language-ts&#34;&gt;export func…</p> https://cve.radiocsirt.org/vuln/ghsa-v228-72c7-fx8j