{"action":"Upgrade a11y-mcp to 1.0.5 or later.","affected":[{"fixed":"1.0.5","introduced":"0"}],"component":"a11y-mcp","cve_ids":["CVE-2026-5323"],"ecosystem":"npm","epss":0.00138,"exploited":false,"fixed_versions":["1.0.5"],"ghsa_id":"GHSA-prmx-7v35-7q82","id":"tcs_01M5KG4DWM21SEX4Q9TG8P3KSS","modified_at":"2026-04-04T05:56:29.037582Z","published_at":"2026-04-02T09:30:24Z","references":["https://osv.dev/vulnerability/GHSA-prmx-7v35-7q82","https://nvd.nist.gov/vuln/detail/CVE-2026-5323","https://github.com/wing3e/public_exp/issues/17","https://github.com/priyankark/a11y-mcp/commit/e3e11c9e8482bd06b82fd9fced67be4856f0dffc","https://github.com/priyankark/a11y-mcp","https://vuldb.com/submit/780752","https://vuldb.com/vuln/354655","https://vuldb.com/vuln/354655/cti"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-prmx-7v35-7q82","url":"https://osv.dev/vulnerability/GHSA-prmx-7v35-7q82"}],"summary":"a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function"}