{"action":"Upgrade gmaps-mcp to 0.1.3 or later.","affected":[{"fixed":"0.1.3","introduced":"0"}],"component":"gmaps-mcp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["0.1.3"],"ghsa_id":"GHSA-52cq-7v8r-62c6","id":"tcs_01M5KEZJNQB046BJJ663C9KN2G","modified_at":"2026-05-08T16:48:27.343537Z","published_at":"2026-05-08T16:32:29Z","references":["https://osv.dev/vulnerability/GHSA-52cq-7v8r-62c6","https://github.com/arthurkatcher/google-maps-mcp/security/advisories/GHSA-52cq-7v8r-62c6","https://github.com/arthurkatcher/google-maps-mcp/commit/00d872507c78e8116bbf9de7be7cd112945c0fd8","https://github.com/arthurkatcher/google-maps-mcp/commit/3ae32643da469f962e67e8ef9726cd4d9bf4587d","https://github.com/arthurkatcher/google-maps-mcp"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-52cq-7v8r-62c6","url":"https://osv.dev/vulnerability/GHSA-52cq-7v8r-62c6"}],"summary":"gmaps-mcp's unauthenticated HTTP transport allows unlimited Google Maps API calls at operator expense"}