All vulnerabilities

CVE-2026-77339 · GHSA-5gm3-9crp-6g3v

Process Compose: browser DNS rebinding lets websites control local MCP tools

mediumCWE-306CWE-346

Vendor

F1bonacc1

Package

github.com/f1bonacc1/process-compose go

Affected

< 1.120.0

Fixed in

1.120.0

Disclosed

2026-09-18

Credit

Avishai Gonen

dns-rebindingmcphost-header

Published advisory