Model Context Protocol

Anthropic's MCP TypeScript SDK, versions up to and including 1.25.1, contains a regular expression denial of service (ReDoS) flaw (CVE-2026-0621) in the UriTemplate class when it processes RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on crafted input, driving CPU use up. An attacker who supplies a malicious URI can make the Node.js process unresponsive.

GHSA-rcfx-77hg-w2wv concerns FastMCP, which does not use the affected components of the MCP SDK directly. However, FastMCP versions prior to 2.14.0 allowed MCP SDK versions below 1.23, which are vulnerable to CVE-2025-66416.

The Model Context Protocol (MCP) Python SDK did not enable DNS rebinding protection by default for HTTP-based servers. A malicious website could exploit DNS rebinding to send requests to an unauthenticated HTTP MCP server running on localhost that was built with FastMCP using streamable HTTP or SSE transport and without TransportSecuritySettings, invoking its tools or accessing its resources on the user's behalf. Servers using stdio transport are not affected.

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When such a server runs on localhost without authentication, using StreamableHTTPServerTransport or SSEServerTransport without enableDnsRebindingProtection enabled, a malicious website could bypass same-origin policy restrictions and invoke tools or access resources on the user's behalf. The issue does not affect servers using stdio transport.

FastMCP's Entra ID integration, as documented, makes the MCP server act as both an OAuth client to Entra ID and an authorization server to MCP clients, with its own `/authorize`, `/token` and `/register` endpoints. The reported issue is a confused deputy scenario that can lead to account takeover, though the source text provided is truncated before the attack details are stated.

CVE-2025-61591 affects Cursor, a code editor built for programming with AI, in versions 1.7 and below. When MCP uses OAuth authentication with an untrusted MCP server, an attacker can impersonate that server and return crafted commands during interaction, enabling command injection. Chained with an untrusted MCP service via OAuth, the flaw could let the agent execute arbitrary code on the host with full user privileges.

Cursor versions 1.6 and below are vulnerable to remote code execution through Visual Studio Code workspace files. An attacker who hijacks the victim's chat context, for example via a compromised MCP server, can use prompt injection to make the Cursor Agent write to a .code-workspace file. This bypasses the fix for CVE-2025-54130 by modifying workspace settings, which leads to RCE.

1Panel, a web interface and MCP Server for managing websites, files, containers, databases and LLMs on Linux servers, is affected through versions 2.0.5 and below. Its HTTPS communication between the Core and Agent endpoints does not fully verify certificates, which allows unauthorized access to interfaces. Because 1Panel exposes many command execution and high-privilege interfaces, this leads to Remote Code Execution.

A validation error in the MCP Python SDK can cause an unhandled exception when it processes malformed requests. The result is service unavailability, returning 500 errors until the server is manually restarted. Impact depends on deployment conditions and any infrastructure-level resilience measures in place.

The MCP Python SDK's streamable HTTP transport has an unhandled exception. A client that deliberately triggers an exception after establishing a streamable HTTP session can cause an uncaught ClosedResourceError on the server. The server then crashes and needs a restart to restore service. Impact depends on deployment conditions and any infrastructure-level resilience measures.

CVE-2025-34072 is a data exfiltration flaw in Anthropic's deprecated Slack Model Context Protocol (MCP) Server, reached through automatic link unfurling. When an AI agent using the server processes untrusted data, it can be manipulated into posting messages with attacker-crafted hyperlinks that embed sensitive data. Slack's link preview bots (Slack-LinkExpanding, Slackbot, Slack-ImgProxy) then request the attacker-controlled URL, leaking private data with no user interaction.

@cyanheads/git-mcp-server, an MCP server for Git repositories, prior to version 2.1.5 has a command injection flaw. Unsanitized input parameters are passed into a child_process.exec call, so an attacker can inject shell metacharacters such as |, >, and && to run arbitrary system commands with the server process's privileges, potentially leading to remote code execution. An MCP client can also be steered into this through indirect prompt injection when asked to read git logs.

Roo Code, an AI-powered autonomous coding agent, stored project-specific MCP configuration in `.roo/mcp.json` within the VS Code workspace. Before version 3.20.3, an attacker who could submit prompts to the agent could have it write a malicious command into that file, leading to arbitrary command execution if the user had enabled auto-approved file writes.