Novice-22

**Name of the Vulnerable Software and Affected Versions** MCPHub versions prior to 1.0.32 **Description** An authenticated non-admin user can register a server pointing to an arbitrary URL, causing the hub to issue server-side requests without egress filtering. This lack of filtering allows requests to loopback, RFC1918, and link-local 169.254.0.0/16 addresses. When using the OpenAPI proxy path, the response body is returned to the caller, resulting in a reflected Server-Side Request Forgery (SSRF), a condition where an attacker induces the server to make requests to an unintended location. When using the SSE/streamable-http transport, the request is sent blind. **Recommendations** Update to version 1.0.32.

**Name of the Vulnerable Software and Affected Versions** browse-mcp versions prior to 0.8.2 **Description** The software contains an arbitrary file write flaw where the `browser download` function writes a fetched response body to a path created by `join(save dir, filename)` without validating the `save dir` variable. Additionally, the `browser save state` and `browser load state` functions honor a caller-controlled `path` without validation. A malicious MCP client or an autonomous agent influenced by indirect prompt injection can specify an arbitrary `save dir` or state `path` and a URL to write attacker-controlled content to any location the process can access, such as `~/.bashrc`, autostart entries, or cron files, potentially leading to host code execution. Furthermore, the `force fetch` fallback uses a raw `fetch()` function that bypasses the `BROWSE MCP ALLOWED ORIGINS` origin fence. **Recommendations** Update to browse-mcp version 0.8.2. As a temporary mitigation, restrict the exposed tools using `BROWSE MCP TOOLS` to exclude the `browser download`, `browser save state`, and `browser load state` functions.