CVE-2026-54504

npm/@andrea9293/mcp-documentation-server CVE-2026-54504: high 8.8

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Action: Upgrade @andrea9293/mcp-documentation-server to 1.13.1 or later.

npm i @andrea9293/mcp-documentation-server@1.13.1

Affected

Fixed versions

Sources

• osv: GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7
• https://github.com/andrea9293/mcp-documentation-server/commit/37159d4e06b8ee50c3645b2496e3d3f6d32c47f9
• https://github.com/andrea9293/mcp-documentation-server
• https://github.com/andrea9293/mcp-documentation-server/releases/tag/v1.13.1

CVE-2026-54504 · published 2026-07-15T23:26:57Z · modified 2026-07-15T23:41:41.409498Z · JSON