@zereight/mcp-gitlab
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover | @zereight/mcp-gitlab | npm | Critical | Fix reported | |
| @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | @zereight/mcp-gitlab | npm | Critical | Fix reported | |
| @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport | @zereight/mcp-gitlab | npm | Critical | Fix reported | |
| @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS | @zereight/mcp-gitlab | npm | High | Fix reported |