All vulnerabilities

CVE-2026-NONE · GHSA-qqh2-7466-82f8

freshrss-mcp: SSRF to loopback and cloud metadata via IPv6-mapped bypass in subscribe_feed and unvalidated import_opml

moderateCVSS 4.9CWE-918

Vendor

ni-c

Package

freshrss-mcp npm

Affected

<= 0.1.4

Fixed in

0.1.5

Disclosed

2026-08-25

Credit

Avishai Gonen

ssrfmcp

Published advisory