CVE-2026-104120

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

CVE-2026-104120

A server-side request forgery (SSRF) vulnerability exists in the modelcontextprotocol components mcp-server-fetch and mcp-server-everything up to version 2026.6.4 . The flaw is located in the fetch_url function within the file mcp_server_fetch/server.py of the Fetch Tool component. An attacker ca...

CVE-2026-104120 modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

EUVD-2026-91161

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

PT-2026-104071

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch url of the file mcp server fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side reque...

Malicious Package

Overview mcp-server-everything is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mcp-server-everything (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263d07d53076b8ca1efe56fcd69d4a4e3c6d6a496b6086a03b8bafb8ae58900c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...