CVE-2026-5607
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
In imprvhub mcp-browser-agent up to version 0.8.0, a server-side request forgery (SSRF) vulnerability exists in the CallToolRequestSchema function of src/handlers.ts. Manipulation of request.params.name and request.params.arguments leads to SSRF. Remote exploitation is possible and the exploit is public.
Risk Assessment
An attacker can remotely send requests to internal network resources, bypassing firewalls and potentially accessing sensitive data or services.
Recommendation
Immediately upgrade mcp-browser-agent to a version above 0.8.0 or apply available patches. If not possible, restrict access to the component.
Original NVD description (English source)
A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.