Skip to content
OpenAdvisories

Package · npm

mcp-sanitizer

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.2
    GHSA-4mfg-r38w-w8fg

    mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

    ## URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 ### Summary `mcp-sanitizer` v1.3.3 fails to block Server-Side Request Forgery (SSRF) targets when a `localhost` URL includes an explicit port (e.g., `http://localh…

    mcp-sanitizer npm
  • High 7.5
    GHSA-7w82-6f9j-v9jp

    mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

    ## File Path Sanitizer Permits Arbitrary User-Home Absolute Paths ### Summary `mcp-sanitizer` v1.3.3 explicitly whitelists `/home/` and `/Users/` as allowed absolute path prefixes in its file path validation logic (`src/utils/validation-utils.js:188-196`). As…

    mcp-sanitizer npm