CVE-2026-81101

Name of the Vulnerable Software and Affected Versions versions prior to 0.2.5

Description The configure command allows the storage of arbitrary endpoint URLs alongside the user's access token. Specifically, the ConfigureCommand.execute() function in src/cli.ts saves the value provided to the endpoint option into the user profile without utilizing the createSafeUrl() function in src/config.ts, which is designed to restrict settings to authorized vendor hosts over HTTPS. Since the connection logic in src/mcp.ts attaches the stored token as a bearer credential to every request sent to the configured endpoint, an attacker could persuade a user to configure a malicious endpoint, resulting in the user's personal access token being sent to the attacker on every subsequent invocation.

Recommendations Update to version 0.2.5.