Skip to content
OpenAdvisories

Package · npm

@frontmcp/adapters

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.9
    GHSA-8q49-2h5h-434x

    FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller

    ## Summary The OpenAPI adapter's spec-change **poller** (`OpenApiSpecPoller`) re-fetched the configured spec `url` on a timer using a raw global `fetch()`, bypassing the SSRF guard (`safeFetch` / `assertUrlSafe`) that `OpenAPIToolGenerator.fromURL()` applies …

    @frontmcp/adapters npm