Skywings

**Name of the Vulnerable Software and Affected Versions** aerostackdev aerostack-mcp versions up to 6315dfde7df0a15aaf743f88d91347115e09ba23 **Description** A remote attacker can trigger server-side request forgery (SSRF)—a flaw that allows a server to be coerced into making unauthorized requests to internal or external resources—by manipulating the `media url` argument within the `upload media()` function of the mcp-whatsapp component. **Recommendations** As a temporary workaround, restrict the use of the `upload media()` function in the mcp-whatsapp component until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** AIAnytime Awesome-MCP-Server versions up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab **Description** A flaw in the `mcp-wiki/wiki-summary` component, specifically within the `mcp-wiki/src/mcp wiki/server.py` file, allows for server-side request forgery (SSRF). This occurs when the `url` argument is manipulated, enabling a remote attacker to initiate unauthorized requests from the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ahujasid blender-mcp versions prior to 5b37be25242e73dc4cf1328974d30458b9e5d67e **Description** Server-side request forgery can be executed remotely via the ZIP File Handler component. The issue exists in the `requests.get()` function within the `src/blender mcp/server.py` file, where manipulation of the `zip file url` argument allows the attack. **Recommendations** Apply patch 5b37be25242e73dc4cf1328974d30458b9e5d67e. As a temporary workaround, restrict access to the ZIP File Handler component or avoid using the `zip file url` argument in the `requests.get()` function.

**Name of the Vulnerable Software and Affected Versions** ahujasid blender-mcp versions prior to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b **Description** Remote code injection is possible through the manipulation of the `code` argument within the `execute blender code()` function located in the `/src/blender mcp/server.py` file. **Recommendations** Update to a version later than 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. As a temporary workaround, restrict access to the `execute blender code()` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** wonderwhy-er DesktopCommanderMCP versions prior to 0.2.39 **Description** A security flaw exists in the `start search` component within the `src/search-manager.ts` file. A remote attacker can manipulate the `SearchResult[]` argument to cause inefficient regular expression complexity, which can lead to a denial of service through excessive resource consumption. **Recommendations** Update to version 0.2.39.

**Name of the Vulnerable Software and Affected Versions** johnhuang316 code-index-mcp versions prior to 2.14.1 **Description** A weakness exists in the `is safe regex pattern()` function within the `search code advanced` component. A remote attacker can manipulate the `regex` argument to cause inefficient regular expression complexity, potentially leading to a denial of service. **Recommendations** Update to version 2.14.1. As a temporary workaround, restrict access to the `is safe regex pattern()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** wonderwhy-er DesktopCommanderMCP version 0.2.37 **Description** An issue exists in the `read file` component within the `readFileFromUrl()` function of the `src/tools/filesystem.ts` file. Remote manipulation of the `url` argument can lead to server-side request forgery (SSRF), a condition where a server is coerced into making unintended requests to an arbitrary destination. **Recommendations** Apply patch 53699bebba9950047bca16ac4dc8f0568f596aaa to version 0.2.37.

**Name of the Vulnerable Software and Affected Versions** ahujasid blender-mcp versions prior to 5b37be25242e73dc4cf1328974d30458b9e5d67e **Description** An injection issue exists in the `Open()` function within the `src/blender mcp/server.py` file. This occurs when the `input image url` argument is manipulated, allowing for remote exploitation. **Recommendations** Deploy the patch 5b37be25242e73dc4cf1328974d30458b9e5d67e. As a temporary workaround, restrict the use of the `input image url` argument in the `Open()` function.

**Name of the Vulnerable Software and Affected Versions** OpenOps versions prior to 0.6.11 **Description** The software allows for remote code execution within the Terraform block. **Recommendations** Update to version 0.6.11 or later.