npm/@contentful/mcp-tools CVE-2026-53957: high 7.7, EPSS 0.41%

Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

Action: Upgrade @contentful/mcp-tools to 0.4.5 or later.

npm i @contentful/mcp-tools@0.4.5

Affected

Fixed versions

Sources

• osv: GHSA-2xhg-73j7-rrgx#npm/@contentful/mcp-tools
• https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx
• https://github.com/contentful/contentful-mcp-server/pull/376
• https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0ca83423fe0
• https://github.com/contentful/contentful-mcp-server
• https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server%401.7.19
• https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools%400.4.5

CVE-2026-53957 · published 2026-08-19T19:17:00Z · modified 2026-08-19T19:33:55.151737Z · JSON