All vulnerabilities

CVE-2026-76807 · GHSA-833v-v58w-294h

Todoist MCP: browser DNS rebinding lets websites write and delete your tasks

criticalCVSS 9.3CWE-346CWE-350

Vendor

Doist

Package

@doist/todoist-mcp npm

Affected

<= 10.3.2

Disclosed

2026-07-10

Credit

Avishai Gonen

dns-rebindingmcp

Published advisory