PT-2026-35504 · Unknown · Mcp-Data-Vis

Mida · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-7146

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AlejandroArciniegas mcp-data-vis versions up to de5a51525a69822290eaee569a1ab447b490746d

Description An issue in the HTTP Request Handler component allows for server-side request forgery, which occurs when an attacker can induce the server to make requests to an unintended location. This can be triggered remotely through the axios() function located in the src/servers/web-scraper/server.js file.

Recommendations As a temporary workaround, consider restricting the use of the axios() function in the src/servers/web-scraper/server.js file until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7146

Affected Products

Mcp-Data-Vis

References · 8

• 🔥 https://github.com/AlejandroArciniegas/mcp-data-vis/issues/1 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7146 · Security Note
• https://github.com/AlejandroArciniegas/mcp-data-vis · Note
• https://vuldb.com/submit/801895 · Note
• https://twitter.com/VulmonFeeds/status/2048955320714633473 · Twitter Post
• https://vuldb.com/vuln/359745 · Note
• https://vuldb.com/vuln/359745/cti · Note
• https://twitter.com/CVEnew/status/2048852115464855710 · Twitter Post