{ "advisories": [ { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "COMM-010", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "4e47f1a00325096be8f391100a97e7f995ef1b359b6df61693587911dcfcd7bf", "id": "x_MCPSA-15bb864c7eef", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-15bb864c7eef.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "npx used without pinned version" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "COMM-010", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "3b8856daacfc9ff739a4bf1ead16aa8e1713ce86c4ffb47117051f704151667a", "id": "x_MCPSA-20ce54c348dd", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-20ce54c348dd.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "npx used without pinned version" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-732" ], "finding_class": "config-hygiene", "mcp_audit_rule_id": "CFHYG-001", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP01" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "513ec4690809b67a44dd763f7eef3732ebf8c33b45b3c5260c539dadb575c3fa", "id": "x_MCPSA-2eafe2970798", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP01" ], "path": "advisories/x_MCPSA-2eafe2970798.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Config file is world-readable" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "cwe_ids": [ "CWE-798" ], "finding_class": "hardcoded-secret", "mcp_audit_rule_id": "CRED-001", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP01" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "eb6efe73ed568a6dc78328f2620f74f14cda5ac92a00aa75b74079a1dc0c4ffe", "id": "x_MCPSA-2fa2713d0891", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP01" ], "path": "advisories/x_MCPSA-2fa2713d0891.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "GitHub credential in environment" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-006", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "75e18e947b455dddd229a2cda85d85fb9166be94ca3cce2f517e9e13b3671d02", "id": "x_MCPSA-38aec9703e90", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05" ], "path": "advisories/x_MCPSA-38aec9703e90.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Inline code execution via -c flag" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-829" ], "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "TRANSPORT-003", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "7ccedd34c3333c42c9e72dfdb9ff5a6849004eaeae4590d924b17b041b23c4c4", "id": "x_MCPSA-3be0fde225cc", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-3be0fde225cc.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Runtime package fetching" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-829" ], "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "TRANSPORT-003", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "d04aaf10ed812813acc230ab8ae94e0695f346ffaab3ce1f4c5908a101e5e110", "id": "x_MCPSA-4deda91e4e28", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-4deda91e4e28.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Runtime package fetching" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "excessive-scope", "mcp_audit_rule_id": "COMM-034", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP06" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "3ea690bf06849ed7e8f3864f51531d60cec238c94f2bc951517142fae0691c68", "id": "x_MCPSA-591f00712156", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP06" ], "path": "advisories/x_MCPSA-591f00712156.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Overprivileged MCP server credential (potential god key)" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "cwe_ids": [ "CWE-312" ], "finding_class": "hardcoded-secret", "mcp_audit_rule_id": "CFHYG-003", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP01" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "1e93f76807e36e12db6826c11af84a41f911e749318067619a02ab3d1f3a19dd", "id": "x_MCPSA-6ddcf6699796", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP01" ], "path": "advisories/x_MCPSA-6ddcf6699796.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Config file stores a plaintext secret inline" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "COMM-013", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04", "MCP05" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "75e13a9cb2b4cf0bd15c34c1d61704d06a2dab1dde79a4ee9ffce8406a9e9c77", "id": "x_MCPSA-6e008dc0208b", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04", "MCP05" ], "path": "advisories/x_MCPSA-6e008dc0208b.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "npx auto-confirm flag (silent execution)" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-004", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05", "MCP09" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "2a516fc50e0200b37510a2c784e2dcc2051f76b4a1a95b1118898d747f6eb3af", "id": "x_MCPSA-82e9ae96b49c", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05", "MCP09" ], "path": "advisories/x_MCPSA-82e9ae96b49c.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Unrecognized stdio server binary" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-732" ], "finding_class": "config-hygiene", "mcp_audit_rule_id": "CFHYG-001", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP01" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "d72910722b7a2ee8367572dbeeca604b5a2c9449a514de9645b582500ae168f7", "id": "x_MCPSA-8502a2645df4", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP01" ], "path": "advisories/x_MCPSA-8502a2645df4.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Config file is world-readable" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "COMM-013", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04", "MCP05" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "684e6d018588f3e983c1f1dd36ae5ab981d55dcfc9dea7121df407f100f0fa46", "id": "x_MCPSA-866c7040087d", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04", "MCP05" ], "path": "advisories/x_MCPSA-866c7040087d.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "npx auto-confirm flag (silent execution)" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "hardcoded-secret", "mcp_audit_rule_id": "COMM-022", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP02" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "a0a4bdf755463ecd5f91847c174d09dcd8b446b4f18d4dc195cd8cb6b89df0be", "id": "x_MCPSA-8b9f60e8b8f0", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP02" ], "path": "advisories/x_MCPSA-8b9f60e8b8f0.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Env key name suggests access token" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-004", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05", "MCP09" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "d98a900d142788763012e8f2d6340f49a397ad016ca9a10795b3139408cce31c", "id": "x_MCPSA-8de3fc9126e5", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05", "MCP09" ], "path": "advisories/x_MCPSA-8de3fc9126e5.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Unrecognized stdio server binary" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-015", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "4a0b0b85b1a36ffc5caacd38fa0f134cb25a38b2e9d3f43f2dc124851dbe21a7", "id": "x_MCPSA-8e7a2699ca2f", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05" ], "path": "advisories/x_MCPSA-8e7a2699ca2f.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Shell metacharacters in server args" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-007", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "fe5cfbef698478ffa6eca34a342ff6456d238ee596c70cb3104ac031f84f49ff", "id": "x_MCPSA-bc1986c4d7bb", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05" ], "path": "advisories/x_MCPSA-bc1986c4d7bb.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "eval or exec passed in args" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "command-injection", "mcp_audit_rule_id": "COMM-004", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP05", "MCP09" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "1f8243a03be12d7701012697150aff441611019e3c38b3325471aef60b5be9bb", "id": "x_MCPSA-c4d98262a4dc", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP05", "MCP09" ], "path": "advisories/x_MCPSA-c4d98262a4dc.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "type": "CVSS_V3" } ], "summary": "Unrecognized stdio server binary" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-732" ], "finding_class": "config-hygiene", "mcp_audit_rule_id": "CFHYG-001", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP01" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "cd42ac9214729f16559b2ddac7707b362e029adfd2efb5854324912a87a8ae79", "id": "x_MCPSA-ca5a39c71bf3", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP01" ], "path": "advisories/x_MCPSA-ca5a39c71bf3.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "type": "CVSS_V3" } ], "summary": "Config file is world-readable" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "excessive-scope", "mcp_audit_rule_id": "COMM-034", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP06" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "mcp-audit-fixture-github-server", "purl": "pkg:npm/mcp-audit-fixture-github-server" }, "ranges": [ { "events": [ { "introduced": "1.0.0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "2354bd57f0535fa48cff0c978ca0ff913a076b77ce07dab58a466cc5191e9e9d", "id": "x_MCPSA-d04e8112d65c", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP06" ], "path": "advisories/x_MCPSA-d04e8112d65c.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Overprivileged MCP server credential (potential god key)" }, { "affected": [ { "database_specific": { "cvss_basis": "finding-class-template", "cwe_ids": [ "CWE-829" ], "finding_class": "typosquat", "mcp_audit_rule_id": "SC-001", "mcp_transport": "stdio", "observation": "package-intrinsic", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "4251373eda3c9d174f7fb3d0ffbf3537adf00fac1a1d5a740aa9ad7b6b95674c", "id": "x_MCPSA-d7cf72bbe399", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-d7cf72bbe399.json", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Possible typosquatting: '@modelcontextprotocol/server-filesytem'" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "cwe_ids": [ "CWE-829" ], "finding_class": "unpinned-dependency", "mcp_audit_rule_id": "TRANSPORT-003", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP04" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesytem", "purl": "pkg:npm/@modelcontextprotocol/server-filesytem" }, "ranges": [ { "events": [ { "introduced": "0" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "f2b960826d2f36eb5f82bcce1bd3c922f988c146d74d7a9bcee2df534f2ba056", "id": "x_MCPSA-fdf85e30ecea", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP04" ], "path": "advisories/x_MCPSA-fdf85e30ecea.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Runtime package fetching" }, { "affected": [ { "database_specific": { "cvss_basis": "severity-band", "finding_class": "excessive-scope", "mcp_audit_rule_id": "COMM-011", "mcp_transport": "stdio", "observation": "deployment", "owasp_mcp": [ "MCP02" ], "verified_patch": { "cosign_bundle": null, "fixed_version": null, "pr_url": null } }, "package": { "ecosystem": "PyPI", "name": "mcp-audit-fixture-shell-runner", "purl": "pkg:pypi/mcp-audit-fixture-shell-runner" }, "ranges": [ { "events": [ { "introduced": "0.3.1" } ], "type": "SEMVER" } ] } ], "canonical_sha256": "12826f84facae5fdf42bdda6ce003397ab2af503f09d39cb10248e1aee410b80", "id": "x_MCPSA-ffd17914efb0", "modified": "2026-10-25T17:16:50Z", "owasp_mcp": [ "MCP02" ], "path": "advisories/x_MCPSA-ffd17914efb0.json", "severity": [ { "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "type": "CVSS_V3" } ], "summary": "Broad Deno permission flags in use" } ], "count": 23, "expires": "2026-11-08T17:16:50Z", "feed_version": "1.1", "generator": "mcp-audit/0.21.1", "published_at": "2026-10-25T17:16:50Z", "signing": { "backend": "minisign", "identity": null, "mode": "key", "oidc_issuer": null }, "snapshot_version": 12, "updated": "2026-10-25T17:16:50Z" }