mcp-webresearch vulnerabilities

CVEs whose affected-version data names the mcp-webresearch package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-65056High· 8.2PoC

2mo ago

mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering

mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visit_page tool, which only valida…

▾ Midnightmzxrai · mcp-webresearchEPSS 0.41%via CVEORG