CVE-2026-49856: @jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version

In @jshookmcp/jshook version 0.3.1, an MCP server (a tool that gives AI agents JavaScript analysis capabilities) has a security gap where ICMP probe and traceroute tools bypass SSRF protections (security rules that block access to private internal networks). This allows an attacker with access to the server to map internal networks and probe private addresses that should be blocked.