Server-side Request Forgery (SSRF)

Overview @frontmcp/sdk is a FrontMCP SDK Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the initialize process. An attacker can access internal network resources or sensitive local files by submitting a crafted OpenAPI specification containing malicious $r...

@frontmcp/adapters (>=1.0.0 <=1.0.3), @frontmcp/plugin-approval (>=1.0.0 <=1.0.3) +7 more potentially affected by CVE-2026-39885 via @frontmcp/sdk (>=1.0.0-beta.1 <=1.0.3)

@frontmcp/sdk NPM version =1.0.0-beta.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.3 Source cves: CVE-2026-39885 Source advisory: SNYK:JS-FRONTMCPSDK-16423474...

Server-side Request Forgery (SSRF)

Overview @frontmcp/adapters is an Adapters for the FrontMCP framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the initialize process. An attacker can access internal network resources or sensitive local files by submitting a crafted OpenAPI...

CVE-2026-39885

CVE-2026-39885 affects FrontMCP (prior to 2.3.0) via the mcp-from-openapi library, which dereferences $ref in OpenAPI specs without URL restrictions, enabling SSRF and local file reads when processing untrusted specs. Fixed in 2.3.0. CVSS v3.1 base score 7.5 (HIGH). Exploitation status not provid...

CVE-2026-39885 FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...

frontmcp 代码问题漏洞

FrontMCP is an open-source MCP server development framework based on TypeScript, created by AgentFront. Versions of FrontMCP prior to 2.3.0 had code-related vulnerabilities. These vulnerabilities stemmed from the lack of restrictions on URL reference resolution, which could lead to server-side...

@frontmcp/adapters (>=0.5.0 <=0.8.0), @frontmcp/plugin-approval (>=0.7.1 <=0.8.0) +9 more potentially affected by CVE-2026-25533 via enclave-vm (>=1.0.3 <=2.7.0)

enclave-vm NPM version =1.0.3, =0.5.0, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.5.0, =0.5.0, =0.5.0, =0.6.1, =0.8.0 - frontmcp =0.5.0 Source cves: CVE-2026-25533 Source advisory: OSV:GHSA-X39W-8VM5-5M3P...

@frontmcp/adapters (>=0.5.0 <=0.8.0), @frontmcp/plugin-approval (>=0.7.1 <=0.8.0) +9 more potentially affected by CVE-2026-25533 via enclave-vm (>=1.0.3 <=2.7.0)

enclave-vm NPM version =1.0.3, =0.5.0, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.7.1, =0.5.0, =0.5.0, =0.5.0, =0.6.1, =0.8.0 - frontmcp =0.5.0 Source cves: CVE-2026-25533 Source advisory: SNYK:JS-ENCLAVEVM-15248348...

@frontmcp/adapters (>=0.5.0 <=0.6.3), @frontmcp/plugins (>=0.5.0 <=0.6.3) +4 more potentially affected by CVE-2026-22686 via enclave-vm (=1.0.3)

enclave-vm NPM version =1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on enclave-vm and may be impacted: - @frontmcp/adapters =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.6.1, =0.6.3 - frontmcp =0.5.0 Source cves: CVE-2026-22686 Source advisory:...