mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

Summary The mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing $ref values pointing to internal network addresses, cloud...

org.webjars.npm:class-validator (>=0.8.5 <=0.14.0), org.webjars.npm:image-thumbnail (=1.0.15) +8 more potentially affected by CVE-2025-56200 via org.webjars.npm:validator (>=10.11.0 <=9.2.0)

org.webjars.npm:validator MAVEN version =10.11.0, =0.8.5, =3.1.2, =3.18.2, =3.25.1 Source cves: CVE-2025-56200 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14102004...