MCP TypeScript SDK EUVD-2025-200274

Exploitation requires ALL of: (1) an MCP server using an HTTP-based transport - specifically StreamableHTTPServerTransport or SSEServerTransport (stdio transport is NOT affected); (2) that server bound to localhost; (3) the server running WITHOUT authentication; (4) enableDnsRebindingProtection left at its insecure default (disabled); and (5) the victim visiting an attacker-controlled website in a browser on the same host, which performs DNS rebinding to defeat the same-origin policy. Limiting factors that reduce realistic risk: the required user interaction of visiting a malicious page (UI:P), the attack-requirement of a functioning DNS rebinding setup (AT:P), the fact that stdio-based and authenticated servers are unaffected, and the vendor's explicit guidance that running unauthenticated HTTP MCP servers on localhost is against MCP security best practices - i.e., the vulnerable configuration is non-default and discouraged.

Signals conflict in a way that lowers real-world priority well below what the 7.6 'High' CVSS 4.0 base score suggests. The high score is driven by VC:H/VI:H (an attacker can invoke tools and read resources), but it is explicitly gated by AT:P (a specific attack requirement - a working DNS rebinding setup) and UI:P (the victim must be lured to a malicious website), and the vulnerable condition is a deployment the vendor explicitly discourages: an unauthenticated HTTP-based MCP server bound to localhost. The EPSS score is only 0.03% (8th percentile), indicating very low predicted exploitation likelihood, and the vulnerability is NOT in CISA KEV and has no public exploit identified - all consistent with this being a defense-in-depth hardening of an insecure default (CWE-1188) rather than an urgent, broadly-exploitable flaw. The CVSS vector (AV:N) and description agree that exploitation is browser-driven over the network, so there is no network-vs-local conflict. Net assessment: a legitimate but conditional issue; prioritize patching only where unauthenticated HTTP/SSE MCP servers are actually run on localhost, otherwise treat as low-urgency hygiene.

A developer runs an MCP server locally over HTTP (StreamableHTTPServerTransport or SSEServerTransport) without authentication and without enabling DNS rebinding protection. While that server is running, the developer visits a malicious web page, which uses DNS rebinding to make the browser treat the attacker's origin as localhost, bypassing the same-origin policy and sending requests to the local MCP server to invoke its tools or read its resources on the user's behalf. No public exploit code is identified at time of analysis, and exploitation requires the victim to visit the attacker's site (UI:P) plus a functioning rebinding setup (AT:P).