npm/@zereight/mcp-gitlab: high 8.1
@zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS
Action: Upgrade @zereight/mcp-gitlab to 2.1.30 or later.
npm i @zereight/mcp-gitlab@2.1.30Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.30 | - |
Fixed versions
| 2.1.30 |
Sources
- osv: GHSA-5648-rgj9-v224
- https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-5648-rgj9-v224
- https://github.com/zereight/gitlab-mcp/issues/596
- https://github.com/zereight/gitlab-mcp/issues/748
- https://github.com/zereight/gitlab-mcp/pull/571
- https://github.com/zereight/gitlab-mcp/pull/624
- https://github.com/zereight/gitlab-mcp/commit/69e784da33e96e64867b511c6f14d3f21f91ba8b
- https://github.com/zereight/gitlab-mcp
- https://github.com/zereight/gitlab-mcp/releases/tag/v2.1.30
published · modified · JSON