Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything.
MediumGHSA-mvf5-2qqv-rg3c25 Oct · today
Does it affect you?
0/4All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory
Timeline
25 Oct34 minfrom publication to Patchwire
- Published by GitHub advisory25 Oct, 00:19 UTC
- Seen by Patchwire +34 min25 Oct, 00:53 UTC
@modelcontextprotocol/server-everything2.0.1
Versions of @modelcontextprotocol/server-everything
2.x
safe 2.0.1
AffectedSafe
Stacks
Not part of a tracked stack.