PT-2025-37732 · Hackmd · Hackmd-Mcp

Yuna0X0 · Published 2025-09-15 · Updated 2025-09-20 · CVE-2025-59155

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions hackmd-mcp versions 1.4.0 through 1.4.9

Description hackmd-mcp is a Model Context Protocol server that integrates HackMD's note-taking platform with AI assistants. A server-side request forgery (SSRF) vulnerability exists in the HTTP transport mode, allowing attackers to redirect outbound API requests to internal network services, access internal endpoints, perform network reconnaissance, and bypass network access controls. The vulnerability occurs because arbitrary hackmdApiUrl values supplied via the Hackmd-Api-Url HTTP header or a base64-encoded JSON query parameter are accepted without validation. The stdio transport mode is not affected.

Recommendations Update to version 1.5.0 or later. Alternatively, switch to stdio mode by setting TRANSPORT=stdio or removing the TRANSPORT environment variable. Restrict outbound network access using firewall rules or network policies. Place the MCP server behind a reverse proxy that validates and filters the Hackmd-Api-Url header and the base64-encoded JSON config query parameter.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-59155

GHSA-G5CG-6C7V-MMPW

Affected Products

Hackmd-Mcp

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59155.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59155 · Security Note
• https://osv.dev/vulnerability/GHSA-g5cg-6c7v-mmpw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59155 · Vendor Advisory
• https://github.com/yuna0x0/hackmd-mcp/releases/tag/v1.5.0 · Note
• https://github.com/yuna0x0/hackmd-mcp/commit/43936c78a5bb3dedc74e8f080607a1125caa8c13 · Note
• https://github.com/yuna0x0/hackmd-mcp · Note
• https://github.com/yuna0x0/hackmd-mcp/security/advisories/GHSA-g5cg-6c7v-mmpw · Note
• https://twitter.com/VulmonFeeds/status/1967778831520940374 · Twitter Post
• https://twitter.com/CVEnew/status/1969292018783289765 · Twitter Post