CVE-2026-15750

Name of the Vulnerable Software and Affected Versions mastergo-design mastergo-magic-mcp versions prior to 0.2.1

Description A remote server-side request forgery (SSRF) exists in the mcp getComponentLink component. The issue resides in the z.string function within the src/tools/get-component-link.ts file, where manipulation of the url argument allows an attacker to induce the server to make unauthorized requests.

Recommendations As a temporary workaround, restrict the use of the url argument in the mcp getComponentLink component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.