Zero Radar
← feed
HighVulnerabilityGHSA-4mfg-r38w-w8fgupdated 28 Oct 2026, 19:52 UTC

mcp-sanitizer lets some localhost and IPv6 loopback URLs bypass its safety check

A tool meant to block risky web addresses can be tricked into fetching internal-only services, such as a database admin page, when the address includes a port number or is written as an IPv6 address in brackets. Those internal responses cou

Fixed in mcp-sanitizer 1.4.0Official source
SeverityHighCVSS 8.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesmcp-sanitizer 1.4.0 · since 28 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends URLCrafted localhost or [::1] address with a port
  2. 2Sanitizer passes URLPort-guard and IPv6 check miss the address
  3. 3Tool fetches URLRequest goes out from the server itself
  4. 4Internal service respondsAdmin or internal data is returned
  5. ResultInternal service responses reach the attacker

What happened

In mcp-sanitizer v1.3.3, validateURLLocation() skips blocking localhost URLs that include an explicit port, and fails to match bracketed IPv6 hostnames like [::1] and [fe80::1], enabling server-side request forgery (SSRF).

Why it is dangerous: An attacker who can supply URLs to MCP tools like web_fetch or web_scraper can reach internal services on the host and read their responses. Anyone running the affected library to gate those tools is at risk.

Are you affected?

You are affected if you use the npm package mcp-sanitizer below 1.4.0 to validate URLs passed to MCP tools such as web_fetch or web_scraper.

Package / productAffected versionsFixed in
mcp-sanitizer · npm< 1.4.01.4.0

What to do

  1. Update mcp-sanitizer to version 1.4.0 or later
  2. If you cannot update yet, block URLs whose host is localhost, 127.0.0.1, or any bracketed IPv6 address before they reach the sanitizer
  3. Review logs for requests to localhost or internal addresses made through web_fetch or web_scraper

Timeline

  1. 28 Oct 2026, 19:51 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:51 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 28 Oct 2026, 19:52 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
GHSA-4mfg-r38w-w8fg
CVSS
8.2 / 10
Disclosed
28 Oct 2026, 19:51 UTC
On Zero Radar
28 Oct 2026, 19:52 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:52 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

mcp-sanitizer lets some localhost and IPv6 loopback URLs bypass its safety check · Zero Radar