CVE-2026-74842

Name of the Vulnerable Software and Affected Versions Kira-Pgr PromptShopMCP versions up to 5bc0cd17358e19a5415d11a531088170d7b81452

Description A server-side request forgery (SSRF) exists in the Image-Toolkit-MCP-Server component within the download image() function of the server.py file. A remote attacker can trigger this issue by manipulating the image url argument. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations As a temporary workaround, restrict the use of the download image() function until a fix is released.