EUVD-2026-18130Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Upgrading to version 1.0.6 is able to resolve this issue. The patch is identified as e3e11c9e8482bd06b82fd9fced67be4856f0dffc. It is recommended to upgrade the affected component. The vendor acknowledged the issue but provides additional context for the CVSS rating: "a11y-mcp is a local stdio MCP server - it has no HTTP endpoint and is not network-accessible. The caller is always the local user or an LLM acting on their behalf with user approval."
AnalysisAI
Server-side request forgery (SSRF) in priyankark a11y-mcp up to version 1.0.5 allows local authenticated attackers to perform arbitrary outbound requests via the A11yServer function in src/index.js, potentially enabling access to internal services or exfiltration of sensitive data. The vulnerability requires local access and user approval (as the tool operates as a local stdio MCP server with no network exposure), and publicly available exploit code exists. Vendor has released patched version 1.0.6 with commit e3e11c9e8482bd06b82fd9fced67be4856f0dffc.
Technical ContextAI
a11y-mcp is a Model Context Protocol (MCP) server that operates exclusively as a local stdio-based service, meaning it communicates via standard input/output rather than network endpoints. The vulnerability exists in the A11yServer function within src/index.js and is classified as CWE-918 (Server-Side Request Forgery). SSRF vulnerabilities in this context allow an attacker (or an LLM operating on behalf of the local user) to craft malicious requests that cause the server to make unintended outbound requests to arbitrary destinations. Since a11y-mcp operates on a rolling release basis without discrete version tags, the affected product is identified by CPE cpe:2.3:a:priyankark:a11y-mcp:*:*:*:*:*:*:*:* covering all versions up to and including 1.0.5. The local-only attack surface significantly constrains real-world exploitation scenarios compared to network-exposed SSRF vulnerabilities.
RemediationAI
Upgrade a11y-mcp to version 1.0.6 or later, which incorporates the fix identified by commit e3e11c9e8482bd06b82fd9fced67be4856f0dffc. Users should obtain the patched version from the official repository at https://github.com/priyankark/a11y-mcp/. Because a11y-mcp operates as a local stdio service with no network exposure, the immediate risk is limited to local environments; however, patching is still recommended as a precaution against potential LLM prompt injection or local privilege escalation scenarios. No workarounds are documented; patching is the definitive remediation.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today