npm/mcp-bridge: critical 9.8
MCP Connect has unauthenticated remote OS command execution via /bridge endpoint
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-wvr4-3wq4-gpc5
- https://github.com/EvalsOne/MCP-connect/security/advisories/GHSA-wvr4-3wq4-gpc5
- https://github.com/EvalsOne/MCP-connect
published · modified · JSON