@modelcontextprotocol/server-everything has 1 advisory. Fixed in 2.0.1.

npm

Versions

Red: affected by at least one advisory. White: safe.

2.x
safe 2.0.1
AffectedSafe

Details

Safe
2.0.1
Advisories
1 in 120 days

Used by

Stacks that pull this package.

Not part of a tracked stack.

Alerts(1)

Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything

@modelcontextprotocol/server-everything · 25 Oct

Medium
Exploitable only if · read by Claude, the source remains the reference
  • Project runs @modelcontextprotocol/server-everything at a version before 2.0.1 (including date-versioned 2025.x/2026.x releases).
  • The server is started with the SSE or StreamableHTTP transport, not the default stdio transport.
  • The server process environment contains secrets such as API keys, database credentials or tokens.
  • A browser on the same machine or network visits an attacker-controlled web page while the server is running.
Affected
@modelcontextprotocol/server-everything >=2025.9.24 <=2026.8.31 · @modelcontextprotocol/server-everything >=1.0.0 <2.0.1
Fixed in
2.0.1
ID
GHSA-mvf5-2qqv-rg3c
Open the alert