CVE-2026-7150— Auto Favicon MCP Server 代码问题漏洞

dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery

A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of the file src/auto_favicon/server.py of the component MCP Tool. The manipulation of the argument image_url results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

服务端请求伪造(SSRF)

Auto Favicon MCP Server 代码问题漏洞

Auto Favicon MCP Server是Yuey个人开发者的一个自动生成网站图标集的工具。 Auto Favicon MCP Server f189116a9259950c2393f114dbcb94dde0ad864b及之前版本存在代码问题漏洞，该漏洞源于MCP Tool组件文件src/auto_favicon/server.py中函数generate_favicon_from_url对参数image_url操作不当，可能导致服务端请求伪造。

N/A

N/A