CVE-2026-42260

HIGH EPSS 11.8%

Published May 12, 20261mo ago · Modified Jun 17, 20262w ago

8.2 CVSS 3.1

High

Published May 12, 2026 1mo ago

Last Modified Jun 17, 2026 2w ago

Description

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.

CVSS Details

Base Score

8.2

Exploitability

3.9

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

11.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

References 1

github.com https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.