CVE-2026-15750
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability has been identified in the mastergo-magic-mcp library up to version 0.2.0. The issue is in the z.string function in the file src/tools/get-component-link.ts, where manipulation of the url argument can lead to requests to arbitrary resources. The attack can be performed remotely, and the exploit has been made public.
Risk Assessment
The organization is at risk of unauthorized access to internal network resources, potentially leading to data leakage or further attacks on other systems.
Recommendation
Immediately update the mastergo-magic-mcp library to a version newer than 0.2.0 if available, or apply temporary mitigations such as URL filtering and restricting access to sensitive resources.
Other vulnerabilities in mastergo-magic-mcp
See all- CVE-2026-15751Medium
A security vulnerability was found in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of the mastergo/component-workflow.md file of the mcp__getComponentGenerator component. Manipulation of the rootPath argument leads to path traversal, allowing access to files outside the intended directory. The attack requires local access, and the exploit has been publicly disclosed.
- CVE-2026-15749Medium
A path traversal vulnerability was discovered in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of src/tools/get-c2d.ts (component mcp__C2d). The attack requires local access and manipulation of the filePath argument. The exploit is public, and the project has not responded to the issue report.
Original NVD description (English source)
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.