CVE-2026-42260

Published: May 12, 2026Modified: May 14, 2026Deferred

8.2

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Exploitability: 3.9 / Impact: 4.2

Source: security-advisories@github.com (Secondary)

Description

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j

Source: security-advisories@github.com

https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.