Description
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-07-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A server‑side request forgery flaw exists in the mastergo‑magic‑mcp library. By manipulating the URL argument provided to the z.string function in src/tools/get-component-link.ts, an attacker can cause the server to perform arbitrary HTTP requests to any destination, potentially exposing internal services or facilitating further attacks. This vulnerability is classified as CWE‑918.

Affected Systems

The flaw affects the mastergo‑magic‑mcp component of mastergo‑design, in all releases up to and including version 0.2.0. The vulnerable code resides in the mcp__getComponentLink component, specifically in the get‑component‑link.ts source file.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact level, while the EPSS score of less than 1 % shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. However, the fact that an exploit has been publicly shared and can be launched remotely means that any installation exposed to the public network remains at tangible risk for attackers to instruct the server to reach internal or private resources.

Generated by OpenCVE AI on July 31, 2026 at 04:31 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install a mastergo‑magic‑mcp release that contains the fix for CVE‑2026‑15750; if a patch is not yet available, monitor the project’s issue tracker for an update and plan to upgrade once the vulnerability is addressed.
  • Modify the application to reject URL requests that target private IP ranges, localhost, or non‑HTTPS schemes by adding explicit validation logic or removing unsupported URL patterns.
  • Restrict outbound connections from the vulnerable service using firewall rules or a dedicated proxy that enforces a whitelist of permissible external destinations, thereby limiting the potential internal resource exposure.

Generated by OpenCVE AI on July 31, 2026 at 04:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
First Time appeared Mastergo-design
Mastergo-design mastergo-magic-mcp
Weaknesses CWE-918
CPEs cpe:2.3:a:mastergo-design:mastergo-magic-mcp:*:*:*:*:*:*:*:*
Vendors & Products Mastergo-design
Mastergo-design mastergo-magic-mcp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mastergo-design Mastergo-magic-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-15T12:44:54.296Z

Reserved: 2026-07-14T15:39:47.644Z

Link: CVE-2026-15750

cve-icon Vulnrichment

Updated: 2026-07-15T12:44:47.656Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:45:17Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)