GHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

Summary

The Model Context Protocol Python SDK's client validated tool results against server-declared outputSchema using jsonschema's default resolver, which fetched any unresolved $ref by opening the URL. A malicious server could make the client request http, https or file URLs from its own network position on every call, and because the fetch ran synchronously with no timeout, a target that stalled would freeze all sessions in the process. Affected versions are 1.10.0 through 1.29.1 and 2.0.0 through 2.1.1, for applications that use the SDK as a client.

Mitigation

Fixed in mcp 1.30.0 (1.x) and 2.2.0 (2.x). The client now resolves references only within the server-sent schema document plus the standard JSON Schema metaschemas. Until upgrading, call tools only on trusted servers. As a partial stopgap, skip tools whose outputSchema contains an $id, or a $ref or $dynamicRef that does not start with #.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mcpPyPILLM dependency since 2024-11-20 · 61 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database
• MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSame vendor · GitHub Advisory Database
• HighGHSA-f897-62hf-6gxq: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch lengthSame vendor · GitHub Advisory Database
• HighGHSA-46jr-4wx8-v453: MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationSame vendor · GitHub Advisory Database
• HighGHSA-22jm-h49p-29qw: MCP TypeScript SDK: Experimental tasks were not tied to the session that created themSame vendor · GitHub Advisory Database