CVE-2026-5607

Name of the Vulnerable Software and Affected Versions imprvhub mcp-browser-agent versions prior to 0.8.1

Description A server-side request forgery (SSRF) issue exists in the URL Parameter Handler component within the CallToolRequestSchema() function of the src/handlers.ts file. This flaw allows a remote attacker to trigger unauthorized requests by manipulating the request.params.name and request.params.arguments variables.

Recommendations Update imprvhub mcp-browser-agent to a version newer than 0.8.0. As a temporary mitigation, restrict access to the CallToolRequestSchema() function to minimize the risk of exploitation.