PT-2026-58827 · Mastergo Design · Mastergo-Magic-Mcp

Mcfly_Zhang · Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-15750

NVD

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-15750

Affected Products

Mastergo-Magic-Mcp

References · 7

• 🔥 https://github.com/mastergo-design/mastergo-magic-mcp/issues/89 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-15750 · Security Note
• https://vuldb.com/cve/CVE-2026-15750 · Note
• https://vuldb.com/vuln/378329 · Note
• https://github.com/mastergo-design/mastergo-magic-mcp · Note
• https://vuldb.com/vuln/378329/cti · Note
• https://vuldb.com/submit/856633 · Note