PyPI/mcp-url-downloader CVE-2026-7158: high 7.3, EPSS 0.29%
mcp-url-downloader has a Server-Side Request Forgery issue
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.1.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-h7xc-4mv8-59fj
- https://nvd.nist.gov/vuln/detail/CVE-2026-7158
- https://github.com/dmitryglhf/url-download-mcp/issues/2
- https://github.com/dmitryglhf/url-download-mcp
- https://vuldb.com/submit/802062
- https://vuldb.com/vuln/359757
- https://vuldb.com/vuln/359757/cti
CVE-2026-7158 · published · modified · JSON