Security vulnerabilities and automated fixes for security vulnerability issues
3 posts found
A critical parsing inconsistency in the ip-address npm package (versions before 10.3.1) allowed Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library decoded IP addresses with leading-zero octets as decimal (e.g., 0127.0.0.1 as 127.0.0.1), while DNS resolvers and system libraries interpreted them as octal (e.g., 0127 as 87 decimal), enabling attackers to bypass IP allowlists and access internal resources.
A critical remote code execution vulnerability in `utils/remote-run.js` allowed attackers to execute arbitrary JavaScript code by passing any malicious URL to the script. The fix implements URL whitelist validation to ensure only trusted sources can be executed, preventing complete system compromise on any machine running the vulnerable code.
The Model Context Protocol (MCP) TypeScript SDK in version 1.17.1 lacked DNS rebinding protection, leaving applications vulnerable to a sophisticated network-level attack. By upgrading to version 1.24.0, DNS rebinding protection is now enabled by default, preventing attackers from exploiting the SDK's HTTP request handling to access internal resources or bypass security controls.