PT-2026-35517 · Unknown · Auto-Favicon

Mida · Published 2026-04-27 · Updated 2026-04-28 · CVE-2026-7150

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions dh1011 auto-favicon versions up to f189116a9259950c2393f114dbcb94dde0ad864b

Description An issue in the MCP Tool component allows remote attackers to perform server-side request forgery (SSRF), which is a flaw where a server is tricked into making unauthorized requests to internal or external resources. This occurs through the manipulation of the image url argument within the generate favicon from url() function located in the 'src/auto favicon/server.py' file.

Recommendations As a temporary workaround, restrict access to or avoid using the generate favicon from url() function until a fix is provided.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-7150

Affected Products

Auto-Favicon

References · 7

• 🔥 https://github.com/dh1011/auto-favicon-mcp/issues/2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7150 · Security Note
• https://vuldb.com/vuln/359749/cti · Note
• https://vuldb.com/submit/802054 · Note
• https://vuldb.com/vuln/359749 · Note
• https://twitter.com/VulmonFeeds/status/2048924599958569321 · Twitter Post
• https://t.me/CVEtracker/51982 · Telegram Post