All vulnerabilities

GHSA-4gfv-c2mm-mvj2

basic-memory: DNS rebinding lets a web page find, exfiltrate and delete private notes via the MCP SSE transport

highCVSS 7.7CWE-306

Vendor

basicmachines-co

Package

basic-memory pip

Affected

< 0.24.0

Fixed in

0.24.0

Disclosed

2026-10-23

Credit

Avishai Gonen

dns-rebindinghost-headermcp

Published advisory