All vulnerabilities

GHSA-j3rv-rv99-hg74

brandsystem-mcp: SSRF blocklist bypass via IPv4-mapped IPv6 literals reaches cloud metadata and loopback

mediumCVSS 6.2CWE-918

Vendor

Brandcode-Studio

Package

@brandsystem/mcp npm

Affected

< 0.17.0

Fixed in

0.17.0

Disclosed

2026-10-25

Credit

Avishai Gonen

ssrfmcp

Published advisory