Vulnerabilities

 1 via 1 paths

Dependencies

 262

Source

 GitHub

Commit

 f1e2a4de

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

high severity
new

Insecure Default Initialization of Resource

  • Vulnerable module: @modelcontextprotocol/sdk
  • Introduced through: @modelcontextprotocol/sdk@1.18.1

Detailed paths

  • Introduced through: secretary-tg@gotois/ProstoDiary_bot#f1e2a4def801e2374913815b5499e6e69ff12d5e › @modelcontextprotocol/sdk@1.18.1
    Remediation: Upgrade to @modelcontextprotocol/sdk@1.24.0.

Overview

@modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript

Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the StreamableHTTPServerTransport or SSEServerTransport process when enableDnsRebindingProtection is not enabled. An attacker can access resources or invoke tools exposed by the local server by exploiting DNS rebinding through a malicious website.

Note: This is only exploitable if the server is running locally over HTTP without authentication and DNS rebinding protection is not enabled.

Remediation

Upgrade @modelcontextprotocol/sdk to version 1.24.0 or higher.

References

Insecure Default Initialization of Resource vulnerability report