Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/f1bonacc1/process-compose

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.1GoAmendedPublished

    Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

    CVE-2026-77339 · GHSA-5gm3-9crp-6g3v

    Affected
    • Go github.com/f1bonacc1/process-compose < 1.120.0
    Fixed in
    1.120.0· Vendor fix available
    Issue
    A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or caller-secret check, then dispatches the requests into process-compose MCP tools. This advisory covers https://github.com/F1bonacc1/process-compose, confirmed at commit d56aa59df04b72f8644811ac581a051bec05e485. The issue is in the MCP SSE transport, not the Gin REST API. The REST API token middleware protects REST routes, but the MCP listener is started separately and does not inherit that protection. Affected Code Root cause: Impact surface: Reproduction Start process-compose from the affected commit with MCP SSE and built-in control tools enabled: In a second terminal, emulate the browser request shape produced by DNS rebinding. A real attacker page keeps Host: attacker.example:8081 and Origin: http://attacker.example:8081 while the hostname…

    Recommended action: Upgrade to 1.120.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →