Description (CNA)
A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| jkawamoto / mcp-florence2 | affected 0.3.0; affected 0.3.1; affected 0.3.2; affected 0.3.3; affected 0.3.4; affected 0.3.5; affected 0.3.6; affected 0.3.7; affected 0.3.8; affected 0.3.9; affected 0.3.10; affected 0.3.11; affected 0.3.12; affected 0.3.13 |
CWE
CWE-918
References
- https://vuldb.com/vuln/391184
- https://vuldb.com/vuln/391184/cti
- https://vuldb.com/cve/CVE-2026-19984
- https://vuldb.com/submit/873920
- https://github.com/jkawamoto/mcp-florence2/issues/59
- https://github.com/jkawamoto/mcp-florence2/
ADP enrichment
No English description supplied.
No references supplied.