{"action":"Upgrade kozou to 1.8.1 or later.","affected":[{"fixed":"1.8.1","introduced":"0"}],"component":"kozou","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["1.8.1"],"ghsa_id":"GHSA-v52w-28xh-v562","id":"tcs_01M5KGARHJMBKMSTS2X39MP499","modified_at":"2026-09-10T03:50:50.585412702Z","published_at":"2026-06-19T20:47:19Z","references":["https://osv.dev/vulnerability/GHSA-v52w-28xh-v562","https://github.com/kozou-dev/kozou/security/advisories/GHSA-v52w-28xh-v562","https://github.com/kozou-dev/kozou"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-v52w-28xh-v562","url":"https://osv.dev/vulnerability/GHSA-v52w-28xh-v562"}],"summary":"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)"}