Skip to content
OpenAdvisories

Package · npm

@utcp/http

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 4.7
    CVE-2026-45366

    typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

    typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() …

    universal-tool-calling-protocol typescript-utcp @utcp/http npm