Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Actor MCP path authority injection leaks Apify token Summary @apify/actors-mcp-server version 0.10.7 builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled webServerMcpPath value taken from an Actor definition returned by the Apify API. An attacker who publishes a malicious Actor with a crafted webServerMcpPath (e.g., @attacker.example/mcp) can cause the MCP client to resolve the final URL to an entirely different host. Because the MCP client unconditionally attaches the victim's Authorization: Bearer <APIFYTOKEN header to every outbound connection, the victim's Apify API token is exfiltrated to the attacker's server. CVSS Base Score: 8.1 (High). Details getActorMCPServerURL() in src/mcp/actors.ts:44 constructs the Actor standby MCP URL by naive string concatenation: mcpServerPath originates from the webServerMcpPath field of an Actor definition fetched from the Apify API (src/utils/actor.ts:24-28). The field is trimmed and comma-split in…
Recommended action: Upgrade to 0.10.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fetch-apify-docs tool validates URLs against a domain allowlist using String.startsWith() instead of proper URL hostname comparison. This allows bypass via attacker-controlled subdomains (e.g., https://docs.apify.com.evil.com/), enabling the tool to fetch and return arbitrary web content to the LLM. Details Vulnerable component src/tools/common/fetchapifydocs.ts, line 51: src/const.ts, lines 167-170: How the bypass works String.startsWith('https://docs.apify.com') matches any string beginning with that prefix, including: - https://docs.apify.com.evil.com/payload - attacker-controlled subdomain - https://docs.apify.com@evil.com/payload - userinfo component in URL (browser behavior varies, but fetch() in Node.js may follow this) - https://docs.apify.com.evil.com:8080/path - custom port on attacker domain All of these pass the startsWith check because they begin with the exact string https://docs.apify.com. The fetched content is returned to the LLM After the allowlist check…
Recommended action: Upgrade to 0.9.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.