CVE-2026-15750

mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery

View on CVE.org
Published Jul 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Analysis

AI-generated

Technical impact

A server‑side request forgery flaw exists in the mastergo‑magic‑mcp library. By manipulating the URL argument provided to the z.string function in src/tools/get-component-link.ts, an attacker can cause the server to perform arbitrary HTTP requests to any destination, potentially exposing internal services or facilitating further attacks. This vulnerability is classified as CWE‑918.

Affected Systems

The flaw affects the mastergo‑magic‑mcp component of mastergo‑design, in all releases up to and including version 0.2.0. The vulnerable code resides in the mcp__getComponentLink component, specifically in the get‑component‑link.ts source file.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact level, while the EPSS score of less than 1 % shows a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. However, the fact that an exploit has been publicly shared and can be launched remotely means that any installation exposed to the public network remains at tangible risk for attackers to instruct the server to reach internal or private resources.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install a mastergo‑magic‑mcp release that contains the fix for CVE‑2026‑15750; if a patch is not yet available, monitor the project’s issue tracker for an update and plan to upgrade once the vulnerability is addressed.
  • Modify the application to reject URL requests that target private IP ranges, localhost, or non‑HTTPS schemes by adding explicit validation logic or removing unsupported URL patterns.
  • Restrict outbound connections from the vulnerable service using firewall rules or a dedicated proxy that enforces a whitelist of permissible external destinations, thereby limiting the potential internal resource exposure.

Generated by OpenCVE AI on July 31, 2026 at 04:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
First Time appeared Mastergo-design
Mastergo-design mastergo-magic-mcp
Weaknesses CWE-918
CPEs cpe:2.3:a:mastergo-design:mastergo-magic-mcp:*:*:*:*:*:*:*:*
Vendors & Products Mastergo-design
Mastergo-design mastergo-magic-mcp
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 15, 2026, 12:44 PM
Reserved
Jul 14, 2026, 3:39 PM

View source JSON

Updated
Jul 15, 2026, 12:44 PM

JSON

Status
Deferred
Published
Jul 14, 2026, 10:16 PM
Modified
Oct 24, 2026, 9:10 PM

View source JSON

No data.

Updated
Jul 31, 2026, 4:45 AM

JSON