EUVD-2026-44515
GHSA-5vh4-8356-p89c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, no privileges required, but user must invoke the tool (UI:R); unchanged scope with limited CIA impact matching CVSS 4.0 VC:L/VI:L/VA:L.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in mastergo-magic-mcp up to version 0.2.0 allows network-adjacent attackers who influence the url argument of the mcp__getComponentLink tool to cause the MCP server to issue arbitrary outbound HTTP requests to internal or external destinations. A publicly available proof-of-concept exploit has been published via GitHub issue #89, and the vendor has not yet responded to the coordinated disclosure. The CVSS 4.0 score of 2.1 with E:P reflects a low-impact, user-interaction-dependent scenario that SSVC independently classifies as non-automatable with only partial technical impact.
Technical ContextAI
mastergo-magic-mcp is a Model Context Protocol (MCP) server that integrates the Mastergo design platform with AI assistant workflows. The vulnerable component is the mcp__getComponentLink tool defined in src/tools/get-component-link.ts, which uses Zod's z.string() validator on the url parameter. CWE-918 (Server-Side Request Forgery) arises because z.string() accepts any string value without enforcing URL scheme restrictions, domain allowlisting, or blocking RFC-1918 private address ranges, allowing the MCP server process to be weaponized as an HTTP proxy. The affected CPE covers mastergo-magic-mcp versions 0.1 and 0.2.0 as confirmed by EUVD-2026-44515.
RemediationAI
No vendor-released patch is available at the time of analysis - the vendor has not responded to the disclosure per GitHub issue #89 (https://github.com/mastergo-design/mastergo-magic-mcp/issues/89). As a compensating control, operators should replace the z.string() validation in src/tools/get-component-link.ts with strict URL allowlisting that permits only the expected Mastergo design platform domain(s), rejecting RFC-1918 addresses, localhost, IPv6 loopback, and non-HTTPS schemes - this directly eliminates the SSRF surface with no functional side effects for legitimate use. Alternatively, the mcp__getComponentLink tool can be disabled entirely in the MCP server configuration if component-link retrieval is not required, at the cost of losing that design integration feature. If neither code change is feasible, deploy the MCP server in a network segment with egress filtering blocking access to internal RFC-1918 ranges and cloud metadata endpoints (e.g., 169.254.169.254), accepting the trade-off that this mitigates pivoting but does not prevent SSRF to external internet targets.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today