Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@jshookmcp/jshook

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3npmAmendedPublished

    @jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization

    CVE-2026-49856 · GHSA-c5r6-m4mr-8q5j

    Affected
    • npm @jshookmcp/jshook >= 0.3.1, <= 0.3.1
    Fixed in
    0.3.2· Vendor fix available
    Issue
    The network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access. The policy is enforced by raw HTTP/TCP/TLS RTT tools, but the ICMP probe and traceroute tools resolve the target and invoke the native ICMP/traceroute sink directly. An MCP client with access to an active network domain can therefore ask the jshookmcp server to probe internal addresses such as 10.0.0.1 even when local SSRF access is disabled for the other raw network tools. This exposes an internal reachability and route mapping primitive from the server network position. Affected code Current main https://github.com/vmoranv/jshookmcp/commit/d309c395738638e384c28c0f599b47b2213ab595 and npm package @jshookmcp/jshook 0.3.1 both contain the issue. - src/server/domains/network/handlers/raw-latency-handlers.ts:61-66: networkrttmeasure parses optional authorization and calls…

    Recommended action: Upgrade to 0.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →