PT-2025-48746 · Unknown · Mcp Typescript Sdk

Publicado 2025-12-02 · Atualizado 2026-06-04 · CVE-2025-66414

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MCP TypeScript SDK versions prior to 1.24.0

Description The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. If an HTTP-based MCP server is running on localhost without authentication, using StreamableHTTPServerTransport or SSEServerTransport, and DNS rebinding protection is not enabled, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions. This could allow an attacker to send requests to the local MCP server and potentially invoke tools or access resources exposed by the server on behalf of the user. This issue does not affect servers using stdio transport. Running HTTP-based MCP servers locally without authentication is not recommended.

Recommendations Update to version 1.24.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-350

CWE-1188

Identificadores relacionados

CVE-2025-66414

GHSA-W48Q-CV73-MX4W

Produtos afetados

Mcp Typescript Sdk

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66414.json · Exploit
• https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-w48q-cv73-mx4w · Aviso do Fabricante
• https://github.com/modelcontextprotocol/typescript-sdk/commit/09623e2aa5044f9e9da62c73d820a8250b9d97ed · Correção
• https://github.com/modelcontextprotocol/typescript-sdk · Nota
• https://github.com/modelcontextprotocol/typescript-sdk/commit/608360047dc6899f1cf4f0226eb62fe7b11b3898 · Nota
• https://github.com/modelcontextprotocol/typescript-sdk/pull/1205 · Nota
• https://t.me/cveNotify/154960 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-w48q-cv73-mx4w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-66414 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1pchx5n/resumen_diario_de_vulnerabilidades_02122025 · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66414 · Nota de Segurança
• https://twitter.com/CVEnew/status/1995929996712427935 · Publicação no Twitter
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-66414 · Aviso do Fabricante
• https://t.me/CVEtracker/38707 · Publicação no Telegram