Skip to content
OpenAdvisories

Vendor

ihor-sokoliuk

4 known vulnerabilities.

Products

mcp-searxng 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-54688

    mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

    mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in src/url-reader…

    ihor-sokoliuk mcp-searxng mcp-searxng npm
  • Medium 6.3
    CVE-2026-54689

    mcp-searxng hardened-mode SSRF bypasses permit internal URL access

    mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and MCP_HTTP_ALL…

    ihor-sokoliuk mcp-searxng mcp-searxng npm