Insecure Default Initialization of Resource

Overview @kozou/api is a Kozou's own REST layer: serves table CRUD / VIEW reads / OpenAPI from a SchemaContext. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server,...

Insecure Default Initialization of Resource

Overview @kozou/core is a Kozou core: Schema Context, type definitions, UI Hints zod schema, DataAdapter interface. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server,...

@kozou/api (>=1.0.0, <=1.8.0), @kozou/codegen (>=1.0.0, <=1.8.0) +5 more potentially affected by unknown CVE via @kozou/core (>=1.0.0, <=1.8.0)

@kozou/core NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

@kozou/api (>=1.0.0, <=1.8.0), @kozou/codegen (>=1.0.0, <=1.8.0) +5 more potentially affected by unknown CVE via @kozou/core (>=1.0.0, <=1.8.0)

@kozou/core NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.7.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: SNYK:JS-KOZOUCORE-17818146...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/mcp (>=1.0.0, <=1.8.0)

@kozou/mcp NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/mcp (>=1.0.0, <=1.8.0)

@kozou/mcp NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: SNYK:JS-KOZOUMCP-17818147...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/api (>=1.0.0, <=1.8.0)

@kozou/api NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/api (>=1.0.0, <=1.8.0)

@kozou/api NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: SNYK:JS-KOZOUAPI-17818148...

NPM: Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

NPM: Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening DNS-rebinding, request-body limits, read-only reads, default network exposure vulnerability discovered by ? in WordPress Npm kozou versions = 1.8.0...

Insecure Default Initialization of Resource

Overview kozou is a Kozou CLI: scaffolding, schema introspection, and MCP server entry points. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to insufficient validation of the Host and Origin headers in the MCP HTTP server, unbounded request-bo...