CVE-2026-19957: graphlit graphlit-mcp-server ssrf-test Endpoint tools.ts fetch server-side request forgery
A vulnerability was identified in graphlit graphlit-mcp-server 1.0.1. This affects the function fetch of the file src/tools.ts of the component ssrf-test Endpoint. Such manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19957?
CVE-2026-19957 has a medium severity score of 6.3.
What components are affected by CVE-2026-19957?
CVE-2026-19957 affects the graphlit graphlit-mcp-server version 1.0.1.
How does CVE-2026-19957 manifest?
CVE-2026-19957 allows for server-side request forgery through manipulation of the 'url' argument in the fetch function.
What impact can CVE-2026-19957 have on a system?
CVE-2026-19957 may allow an attacker to perform remote exploits that compromise server integrity.
How can I mitigate CVE-2026-19957?
To mitigate CVE-2026-19957, ensure that proper input validation and restrictions are implemented for the URL handling in the application.