{"action":"Upgrade @contentful/mcp-tools to 0.4.5 or later.","affected":[{"fixed":"0.4.5","introduced":"0"}],"component":"@contentful/mcp-tools","cve_ids":["CVE-2026-53957"],"ecosystem":"npm","epss":0.00415,"exploited":false,"fixed_versions":["0.4.5"],"ghsa_id":"GHSA-2xhg-73j7-rrgx","id":"tcs_01M5KEVEEJCMKXP6026YF2KE8T","modified_at":"2026-08-19T19:33:55.151737Z","published_at":"2026-08-19T19:17:00Z","references":["https://osv.dev/vulnerability/GHSA-2xhg-73j7-rrgx","https://github.com/contentful/contentful-mcp-server/security/advisories/GHSA-2xhg-73j7-rrgx","https://github.com/contentful/contentful-mcp-server/pull/376","https://github.com/contentful/contentful-mcp-server/commit/fa7477ee48515f4248bc91a025eab0ca83423fe0","https://github.com/contentful/contentful-mcp-server","https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-server%401.7.19","https://github.com/contentful/contentful-mcp-server/releases/tag/mcp-tools%400.4.5"],"severity":{"label":"high","score":7.7},"sources":[{"source":"osv","source_id":"GHSA-2xhg-73j7-rrgx#npm/@contentful/mcp-tools","url":"https://osv.dev/vulnerability/GHSA-2xhg-73j7-rrgx"}],"summary":"Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint"}