CVE-2026-59973: Server-Side Request Forgery (SSRF)

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec forwards untrusted OpenAPI url and spec inputs and...

@frontmcp/plugin-skilled-openapi (>=1.2.1, <=1.4.1) potentially affected by CVE-2026-59973 via @frontmcp/adapters (>=1.2.1, <=1.4.1)

@frontmcp/adapters NPM version =1.2.1, =1.2.1, =1.4.1 Source cves: CVE-2026-59973 Source advisory: OSV:GHSA-65H7-9WRW-629C...

@frontmcp/plugin-skilled-openapi (>=0.0.1, <=1.5.5) potentially affected by unknown CVE via @frontmcp/adapters (>=1.0.4, <=1.5.5)

@frontmcp/adapters NPM version =1.0.4, =0.0.1, =1.5.5 Source cves: unknown CVE Source advisory: OSV:GHSA-8Q49-2H5H-434X...

Server-side Request Forgery (SSRF)

Overview @frontmcp/adapters is an Adapters for the FrontMCP framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the initialize process. An attacker can access internal network resources or sensitive local files by submitting a crafted OpenAPI...

@frontmcp/adapters (>=0.5.0, <=1.0.3), frontmcp (0.5.0) potentially affected by CVE-2026-39885 via mcp-from-openapi (>=2.0.0, <=2.1.2)

mcp-from-openapi NPM version =2.0.0, =0.5.0, =1.0.3 - frontmcp 0.5.0 Source cves: CVE-2026-39885 Source advisory: OSV:GHSA-V6PH-XCQ9-QXXJ...