{"action":"Upgrade mcp-searxng to 1.2.1 or later.","affected":[{"fixed":"1.2.1","introduced":"0"}],"component":"mcp-searxng","cve_ids":["CVE-2026-54688"],"ecosystem":"npm","epss":0.00499,"exploited":false,"fixed_versions":["1.2.1"],"ghsa_id":"GHSA-q87f-qc2r-2gw4","id":"tcs_01M5KG5N9GBQYAK070BJY96CJJ","modified_at":"2026-08-19T19:33:55.245527Z","published_at":"2026-08-19T19:23:08Z","references":["https://osv.dev/vulnerability/GHSA-q87f-qc2r-2gw4","https://github.com/ihor-sokoliuk/mcp-searxng/security/advisories/GHSA-q87f-qc2r-2gw4","https://github.com/ihor-sokoliuk/mcp-searxng/issues/87#issuecomment-4645453694","https://github.com/ihor-sokoliuk/mcp-searxng","https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.2.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-q87f-qc2r-2gw4","url":"https://osv.dev/vulnerability/GHSA-q87f-qc2r-2gw4"}],"summary":"SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)"}