CVE-2026-42260

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.2 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N                                    

Vulnerability Description

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.

Vulnerability Details

Published Date

May 05, 2026

Last Modified

May 12, 2026

CWE ID

CWE-918

Source

GitHub

Vendor

npm

Product

open-websearch

External References

https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j
https://github.com/advisories/GHSA-v228-72c7-fx8j

CVE-2026-42260

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment