PyPI/meta-ads-mcp CVE-2026-54549: high 8.3, EPSS 0.40%
meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
Action: Upgrade meta-ads-mcp to 1.0.115 or later.
pip install meta-ads-mcp==1.0.115Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.0.115 | - |
Fixed versions
| 1.0.115 |
Sources
- osv: GHSA-45gf-fjxp-cjpq
- https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-45gf-fjxp-cjpq
- https://github.com/pipeboard-co/meta-ads-mcp/commit/7d9926336bbdac6285a988d043c4ccfe126c94c5
- https://github.com/pipeboard-co/meta-ads-mcp
- https://github.com/pipeboard-co/meta-ads-mcp/releases/tag/1.0.115
CVE-2026-54549 · published · modified · JSON