EUVD-2026-25912Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF requiring authentication (PR:L); partial confidentiality and integrity impact limited to accessible internal resources; no availability impact evident; scope unchanged per reporter assessment.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of the file src/auto_favicon/server.py of the component MCP Tool. The manipulation of the argument image_url results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in the auto-favicon MCP tool's generate_favicon_from_url function enables authenticated remote attackers to coerce the server into issuing arbitrary outbound HTTP requests, potentially reaching internal network resources, cloud metadata endpoints, or other services inaccessible from the internet. All versions of dh1011/auto-favicon-mcp up to commit f189116a9259950c2393f114dbcb94dde0ad864b are affected, with no vendor patch available. A public exploit has been disclosed; however, EPSS sits at 0.03% (10th percentile) and CISA SSVC rates it non-automatable with partial technical impact, placing real-world exploitation risk at the lower end of the threat spectrum.
Technical ContextAI
The auto-favicon project is a Model Context Protocol (MCP) tool that generates favicons by fetching remote images. The vulnerable component is the generate_favicon_from_url function in src/auto_favicon/server.py, which accepts a caller-controlled image_url argument and issues an outbound HTTP request without sufficient URL validation or allowlist enforcement. CWE-918 (Server-Side Request Forgery) identifies the root cause: the server acts as an unintended HTTP proxy, forwarding attacker-controlled URLs to internal or restricted destinations. This class of vulnerability is particularly impactful when the hosting environment can reach cloud instance metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, or non-routable RFC 1918 addresses. The product uses a rolling release model with no semantic versioning, making patch tracking reliant on commit hashes rather than release tags.
RemediationAI
No vendor-released patch has been identified at time of analysis; the maintainer was notified via issue report (https://github.com/dh1011/auto-favicon-mcp/issues/2) but has not responded. The primary fix requires adding URL validation in generate_favicon_from_url within src/auto_favicon/server.py: implement a strict allowlist of permitted URL schemes and hostnames, and explicitly deny requests targeting private IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16) to block cloud metadata endpoint abuse. As a network-layer compensating control, restrict outbound HTTP/HTTPS egress from the host running the MCP tool to only permitted external domains - this eliminates the SSRF reach without code changes but may break legitimate favicon fetching for some URLs. Enabling IMDSv2 on AWS EC2 instances (requiring a session-oriented token) removes the most critical SSRF escalation path in cloud environments with no application-side trade-offs. Monitor the upstream GitHub issue for a vendor-supplied fix.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today