mcp-searxng vulnerabilities
CVEs whose affected-version data names the mcp-searxng package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-58485High· 7.1PoCmcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the …
CVE-2026-58483High· 7.5PoCmcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-rea…
CVE-2026-54688Medium· 6.5PoCmcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllow…
CVE-2026-54689Medium· 6.3PoCmcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is en…
GHSA-hjwh-xvfw-qrwjMedium· 5.5SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
GHSA-xcqx-9jf5-w339High· 7.5SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
GHSA-mrvx-jmjw-vggcHigh· 7.1SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`
SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`