npm/@samanhappy/mcphub CVE-2026-79743: high, EPSS 0.54%
MCPHub has Path Traversal via Malicious MCPB Manifest Name
Action: Upgrade @samanhappy/mcphub to 0.12.13 or later.
npm i @samanhappy/mcphub@0.12.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.13 | - |
Fixed versions
| 0.12.13 |
Sources
- osv: GHSA-p3h2-2j4p-p83g
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-p3h2-2j4p-p83g
- https://github.com/samanhappy/mcphub/commit/af5b013c09bb0add6b7ad9aaa5b875cf150d2a7c
- https://github.com/samanhappy/mcphub
CVE-2026-79743 · published · modified · JSON