CVE-2026-42260
1 advisory.
npm/open-websearch CVE-2026-42260: high 8.2, EPSS 0.36%
open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Action: Upgrade open-websearch to 2.1.7 or later.
npm i open-websearch@2.1.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.7 | - |
Fixed versions
| 2.1.7 |
Sources
- osv: GHSA-v228-72c7-fx8j
- https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j
- https://nvd.nist.gov/vuln/detail/CVE-2026-42260
- https://github.com/Aas-ee/open-webSearch
CVE-2026-42260 · published · modified · JSON