kozou

Ecosystem: npm

Downloads:

Vulnerabilities from the last (months)

Severity distribution (all time)

1vulnerability

Critical0 (0.0%)
High1 (100.0%)
Medium0 (0.0%)
Moderate0 (0.0%)
Low0 (0.0%)

Monthly breakdown

Known vulnerabilities affecting kozou, based on data from OSV.

Filter by severitySort by

Vulnerabilities affecting kozou
ID	Severity	Summary	Affected versions	Published	Source
GHSA-v52w-28xh-v562	High	Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in 1.8.1. ## Issues 1. MCP HTTP server lacked DNS-rebinding protection. The Streamable HTTP transport is unauthenticated and loopback by default. Without `Host`/`Origin` validation, a malicious web page in the operator's browser could rebind a hostname it controls to the loopback address and drive the MCP endpoint — reading schema metadata, or (when the opt-in `call` execution tool is enabled) executing exposed	`< 1.8.1`	2026-06-19	GitHub (opens in a new tab)

GHSA-v52w-28xh-v562High
Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)
- < 1.8.1
2026-06-19GitHub (opens in a new tab)
Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in **1.8.1**. ## Issues 1. **MCP HTTP server lacked DNS-rebinding protection.** The Streamable HTTP transport is unauthenticated and loopback by default. Without `Host`/`Origin` validation, a malicious web page in the operator's browser could rebind a hostname it controls to the loopback address and drive the MCP endpoint — reading schema metadata, or (when the opt-in `call` execution tool is enabled) executing exposed