Tianyuli

**Name of the Vulnerable Software and Affected Versions** kylecui NetForensicMCP version 2.1.0 **Description** A flaw in the `execAsync()` function within the index.js file allows for remote command injection. This occurs when the `interface/protocol` argument is manipulated, enabling an attacker to execute arbitrary commands on the system. **Recommendations** As a temporary workaround, restrict the use of the `execAsync()` function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** jiantao88 android-mcp-server versions prior to 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a **Description** An OS command injection flaw exists in the Command Execution component within the `child process.exec()` function of the `build/index.js` file. A local attacker can exploit this by manipulating the `deviceId`, `packageName`, `permission`, `extras[].key`, or `extras[].value` arguments. OS command injection is a vulnerability that allows an attacker to execute arbitrary operating system commands on the server. **Recommendations** Apply patch 14e2bf27c88ba137e35cbb0c2a75f72b595bb98a to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** jkawamoto mcp-florence2 versions prior to 0.3.14 **Description** A flaw in the `get images()` function within the `src/mcp florence2/ init .py` file allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This occurs through the manipulation of the `src` argument and can be initiated remotely. **Recommendations** Route all HTTP(S) requests through an SSRF-safe proxy server to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Kira-Pgr PromptShopMCP versions up to 5bc0cd17358e19a5415d11a531088170d7b81452 **Description** A server-side request forgery (SSRF) exists in the Image-Toolkit-MCP-Server component within the `download image()` function of the `server.py` file. A remote attacker can trigger this issue by manipulating the `image url` argument. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. **Recommendations** As a temporary workaround, restrict the use of the `download image()` function until a fix is released.

**Name of the Vulnerable Software and Affected Versions** gomarble-ai facebook-ads-mcp-server version 0.1.0 **Description** A remote attacker can perform server-side request forgery (SSRF), a technique where the server is coerced into making unauthorized requests to internal or external resources, by manipulating the `fetch pagination url()` function within the `server.py` file. **Recommendations** Apply patch 4e53875aa22e8991c2fa4a7660d86e1caba66659 for version 0.1.0. As a temporary workaround, restrict the use of the `fetch pagination url()` function until the patch is applied.

**Name of the Vulnerable Software and Affected Versions** graphlit graphlit-mcp-server version 1.0.1 **Description** A server-side request forgery (SSRF) issue exists in the ssrf-test Endpoint within the `fetch()` function of the `src/tools.ts` file. This occurs when the `url` argument is manipulated, allowing a remote attacker to induce the server to make unauthorized requests. **Recommendations** As a temporary workaround, restrict the use of the `url` argument in the `fetch()` function of the `src/tools.ts` file. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** iatsiuk pptr-mcp versions prior to 0.2.8 **Description** A flaw in the execute Tool component allows for remote code injection. The issue resides within the `executeCode()` function located in the `src/vm-executor.ts` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the `executeCode()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Jij-Inc Jij-MCP-Server version 0.1.0 **Description** Code injection is possible via remote attack in the `jm check` component. The issue exists within the `PythonREPL.run()` function located in the `jij mcp/python repr.py` file, where manipulation of the `code` argument allows for the execution of arbitrary code. **Recommendations** As a temporary workaround, restrict access to the `PythonREPL.run()` function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.