npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

npm: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6

URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 Summary mcp-sanitizer v1.3.3 fails to block Server-Side Request Forgery SSRF targets when a localhost URL includes an explicit port e.g., http://localhost:8080/ or when an IPv6 loopback/link-local address...

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

npm: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths vulnerability discovered by ? in WordPress npm mcp-sanitizer versions 1.4.0...

mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths

File Path Sanitizer Permits Arbitrary User-Home Absolute Paths Summary mcp-sanitizer v1.3.3 explicitly whitelists /home/ and /Users/ as allowed absolute path prefixes in its file path validation logic src/utils/validation-utils.js:188-196. As a result, paths such as /home/alice/.ssh/idrsa and...