Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

camofox-mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.0npmAmendedPublished

    CamoFox MCP: Unauthenticated HTTP MCP browser-control surface

    GHSA-7hgr-7h44-33w2

    Affected
    • npm camofox-mcp < 1.13.2
    Fixed in
    1.13.2· Vendor fix available
    Issue
    Unauthenticated HTTP MCP browser-control surface in camofox-mcp Summary camofox-mcp exposed a Streamable HTTP MCP endpoint at /mcp with rate limiting but no inbound MCP-layer authentication. When HTTP mode was enabled, any client that could reach /mcp could list and invoke browser-control tools. If CAMOFOXAPIKEY was configured, the server then forwarded that server-side key to the underlying camofox-browser backend. That means an unauthenticated MCP caller could exercise the server's browser authority without knowing the backend browser API key. Reviewed vulnerable commit: 10e3ac08cb50d830eb4ee00a789229f02f28a1a4 Fixed commit observed on main: 599f56ee40f8062aeca541c251ed1d39fb437f50 Fixed release observed: v1.13.2 Suggested severity: High, with the caveat that default loopback-only deployments reduce practical exposure. Root cause In the reviewed commit, src/http.ts creates the Express MCP app and applies only a rate limiter to /mcp: The POST /mcp handler then creates a server and…

    Recommended action: Upgrade to 1.13.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →