@aborruso/ckan-mcp-server

npm · Package

7 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)CVE-2026-76894 · GHSA-VQFF-R82H-9CRC	@aborruso/ckan-mcp-server	npm	Low	Fix reported	2026-10-16
@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509CVE-2026-61612 · GHSA-798P-78G2-V556	@aborruso/ckan-mcp-server	npm	Medium	Fix reported	2026-09-23
@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)CVE-2026-53509 · GHSA-G84H-J7JJ-X32P	@aborruso/ckan-mcp-server	npm	Medium	Fix reported	2026-09-23
SSRF in @aborruso/ckan-mcp-server via base_url allows access to internal networksCVE-2026-33060 · GHSA-3XM7-QW7J-QC8V	@aborruso/ckan-mcp-server	npm	Medium	Fix reported	2026-09-23
CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoningCVE-2026-73846 · GHSA-78X9-FHHX-V2G6	@aborruso/ckan-mcp-server	npm	Medium	Fix reported	2026-09-03
CKAN MCP Server: Information disclosure via verbose error reflectionCVE-2026-73844 · GHSA-6F9W-9HF2-5RG3	@aborruso/ckan-mcp-server	npm	Low	Fix reported	2026-09-03
CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)CVE-2026-73845 · GHSA-83X6-42HR-JC76	@aborruso/ckan-mcp-server	npm	Medium	Fix reported	2026-09-02