Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

line-desktop-mcp

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmAmendedPublished

    Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

    CVE-2026-49357 · GHSA-4hf8-5mjm-rfgq

    Affected
    • npm line-desktop-mcp <= 1.1.1
    Fixed in
    1.1.2· Vendor fix available
    Issue
    Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication Summary line-desktop-mcp supports a --http-mode Streamable HTTP transport for use with clients such as n8n. In this mode the server binds to 0.0.0.0 and exposes the MCP /mcp endpoint without an MCP-layer authentication check. Any network client that can reach the port can initialize a session, list tools, and call tools that read LINE Desktop chat history or send LINE messages through the already logged-in desktop application. This is High for deployments where the HTTP port is reachable beyond the local host, because the server acts with the user authority of the logged-in LINE Desktop session. It is lower if the listener is strictly firewalled to trusted local clients. Affected version Repository: dtwang/line-desktop-mcp Current source checked: fbed0d2d3048e63f48a356a1267ed8ec5e78f3ae on main, committed 2026-05-14. Published npm package checked: line-desktop-mcp@1.1.1. Source evidence README.md…

    Recommended action: Upgrade to 1.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →