Skip to main content

npm EUVDEUVD-2026-79999

| CVE-2026-61568 CRITICAL
Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)
2026-09-15 security-advisories@github.com GHSA-vmp7-252j-cwp7
Information Disclosure Gitlab npm
9.6
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
9.6 CRITICAL
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 16, 2026 - 06:40 vuln.today
tag: npm added
POC Analysis Generated
Sep 15, 2026 - 23:22 vuln.today
Patch available
Sep 15, 2026 - 22:20 EUVD
Source Code Evidence Fetched
Sep 15, 2026 - 21:43 vuln.today
Analysis Generated
Sep 15, 2026 - 21:43 vuln.today
CVE Published
Sep 15, 2026 - 21:16 cve.org
CRITICAL 9.6

DescriptionCVE.org

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled Host and Origin. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch.

Articles & Coverage 1

News We need answer JSON only. Need synthesize. Need parse data. Need produce fields. But user request initially: "Generate a concise, SEO-friendly article title about a security vulnerability. Format: ... Max 100 chars. Return ONLY the title, no quotes." Then they provided CVE, Product, Severity, Summary: "We need answer JSON only. Need synthesize. Need comply with field constraints. Need parse data. We need produce product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_ Sep 15, 2026

Analysis

@zereight/mcp-gitlab is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in npm

View all
CVE-2021-43616 CRITICAL POC
9.8 Nov 13

The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in pack
CVE-2016-3956 HIGH
7.5 Jul 02

The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before
CVE-2019-16776 HIGH
8.1 Dec 13

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated high severity (CVSS 8.1), this

CVE-2021-26700 HIGH
7.8 Feb 25

Visual Studio Code npm-script Extension Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulner
CVE-2018-7408 HIGH
7.8 Feb 22

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically inst
CVE-2022-29244 HIGH
7.5 Jun 13

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a worksp
CVE-2019-16777 MEDIUM
6.5 Dec 13

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. Rated medium severity (CVSS 6.5),
CVE-2019-16775 MEDIUM
6.5 Dec 13

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. Rated medium severity (CVSS 6.5), thi
CVE-2020-15095 MEDIUM
4.4 Jul 07

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. Rated

Same weakness CWE-350 – Reliance on Reverse DNS Resolution for a Security-Critical Action

View all
CVE-2017-0902 HIGH POC
8.1
CVE-2026-55526 HIGH POC
8.5
CVE-2026-55391 HIGH POC
7.5
CVE-2021-22884 HIGH POC
7.5
CVE-2026-53708 MEDIUM POC
6.6
CVE-2026-1490 CRITICAL
9.8
CVE-2021-34561 HIGH
8.8
CVE-2018-7160 HIGH
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

EUVD-2026-79999 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy