npm/@samanhappy/mcphub: critical 9.1
@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation
Action: Upgrade @samanhappy/mcphub to 0.12.15 or later.
npm i @samanhappy/mcphub@0.12.15Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.15 | - |
Fixed versions
| 0.12.15 |
Sources
- osv: GHSA-wf8q-wvv8-p8jf
- https://github.com/samanhappy/mcphub/security/advisories/GHSA-wf8q-wvv8-p8jf
- https://github.com/samanhappy/mcphub
- https://github.com/samanhappy/mcphub/releases/tag/v0.12.15
published · modified · JSON