Skip to content
OpenAdvisories

Package · npm

@arikusi/deepseek-mcp-server

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.6
    CVE-2026-55604

    @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

    DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding them to any authenticated principal or transport session.…

    arikusi deepseek-mcp-server @arikusi/deepseek-mcp-server npm
  • Medium 5.3
    CVE-2026-55605

    @arikusi/deepseek-mcp-server Missing Authentication on Self-Hosted HTTP MCP Endpoint

    DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.8.0, the self-hosted HTTP transport of `@arikusi/deepseek-mcp-server` exposes `POST /mcp` without any authentication: `createMcpExpressApp` is called withou…

    arikusi deepseek-mcp-server @arikusi/deepseek-mcp-server npm