Go to packages list

mcp-from-openapi

Ecosystem: npm

Downloads: 60.61 K

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 2HighAffects 2 versions
  • 0MediumAffects 0 versions
  • 0ModerateAffects 0 versions
  • 0LowAffects 0 versions
Severity distribution (all time)
2vulnerabilities
  • Critical0 (0.0%)
  • High2 (100.0%)
  • Medium0 (0.0%)
  • Moderate0 (0.0%)
  • Low0 (0.0%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0
  • 1 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 0

Vulnerabilities (2)

Known vulnerabilities affecting mcp-from-openapi, based on data from OSV.

Vulnerabilities affecting mcp-from-openapi
IDSeveritySummaryAffected versionsPublishedSource
GHSA-65h7-9wrw-629cHighFrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix## Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax. FrontMCP latest release v1.2.1 and current main still call `OpenAPIToolGenerator.fromURL()` and `OpenAPIToolGenerator.fromJSON()` from `mcp-from-openapi` 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP d
  • >= 2.3.0, < 2.5.0
GitHub (opens in a new tab)
GHSA-v6ph-xcq9-qxxjHighmcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications## Summary The `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. ## Affected Versions `<= 2.1.2` (latest) ## C
  • < 2.3.0
GitHub (opens in a new tab)
  • GHSA-65h7-9wrw-629cHigh
    FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix
    • >= 2.3.0, < 2.5.0
    GitHub (opens in a new tab)

    ## Summary The published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax. FrontMCP latest release v1.2.1 and current main still call `OpenAPIToolGenerator.fromURL()` and `OpenAPIToolGenerator.fromJSON()` from `mcp-from-openapi` 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP d

    CVE: CVE-2026-59973

  • GHSA-v6ph-xcq9-qxxjHigh
    mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
    • < 2.3.0
    GitHub (opens in a new tab)

    ## Summary The `mcp-from-openapi` library uses `@apidevtools/json-schema-ref-parser` to dereference `$ref` pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenAPI specification containing `$ref` values pointing to internal network addresses, cloud metadata endpoints, or local files will cause the library to fetch those resources during the `initialize()` call. This enables Server-Side Request Forgery (SSRF) and local file read attacks when processing untrusted OpenAPI specifications. ## Affected Versions `<= 2.1.2` (latest) ## C

    CVE: CVE-2026-39885

Showing 1-2 of 2 vulnerabilities