CVE-2026-19770

Name of the Vulnerable Software and Affected Versions feedmob fm-mcp-servers version 0.0.3

Description An issue exists in the Download Endpoint component within the downloadReport() function located in the src/smadex-reporting/src/index.ts file. Manipulation of the downloadUrl argument allows for server-side request forgery, a technique where an attacker induces the server to make requests to an unintended location. This attack can only be executed from a local environment.

Recommendations As a temporary workaround, restrict the use of the downloadReport() function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.