Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-15750— mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery

CVSS 6.3 · Medium EPSS 0.23% · P13

Possible ATT&CK Techniques 1AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProductVersion RangeStatus
mastergo-designmastergo-magic-mcp0.1affected
0.2.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-15750

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
Source: NVD (National Vulnerability Database)
Vulnerability Description
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
MasterGo Magic MCP 服务端请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MasterGo MasterGo Magic MCP是中国MasterGo公司的一款独立的 MCP（模型上下文协议）服务。 MasterGo Magic MCP 0.2.0及之前版本存在服务端请求伪造漏洞，该漏洞源于组件mcp__getComponentLink中文件src/tools/get-component-link.ts的函数z.string对参数url的操作，可能导致服务端请求伪造。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
mastergo-designmastergo-magic-mcp 0.1 cpe:2.3:a:mastergo-design:mastergo-magic-mcp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-15750

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15750

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-15750 (1)

Same Patch Batch · mastergo-design · 2026-07-14 · 3 CVEs total

CVE-2026-157495.3 MEDIUMmastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversal
CVE-2026-157515.3 MEDIUMmastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execut

IV. Related Vulnerabilities

Same product: mastergo-magic-mcp
Same vendor: mastergo-design
Same weakness: CWE-918

V. Comments for CVE-2026-15750

No comments yet

Leave a comment