{"id":"EUVD-2026-29478","enisaUuid":"7bcbefba-cc31-3a92-8690-9b0b30ac2ca4","description":"Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.","datePublished":"May 12, 2026, 2:09:05 PM","dateUpdated":"May 14, 2026, 7:10:56 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j\n","aliases":"CVE-2026-42260\nGHSA-v228-72c7-fx8j\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"acd83d90-2a49-344c-b896-e4354c04bbc2","product":{"name":"open-webSearch","vendor":{"name":"Aas-ee"}},"product_version":"\u003c 2.1.7"}],"enisaIdVendor":[{"id":"b9255014-faf3-3149-a775-1e0496fa3411","vendor":{"name":"Aas-ee"}}],"enisaIdVulnerability":[{"id":"11b8cd4a-ef54-396a-b4c1-6ba069a44f49","vulnerability":{"id":"CVE-2026-42260","description":"Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to 2.1.7, isPublicHttpUrl / assertPublicHttpUrl in src/utils/urlSafety.ts do not recognize bracketed IPv6 literals and do not resolve DNS, which combine to allow non-blind SSRF with the response body returned to the caller. This vulnerability is fixed in 2.1.7.","datePublished":"May 12, 2026, 2:09:05 PM","dateUpdated":"May 14, 2026, 7:10:56 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j\n","enisa_id":"EUVD-2026-29478\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 27, 2026, 7:17:29 AM","vulnerabilityProduct":[{"id":"dfe44a48-8cc1-3684-8df3-4f4e6fedf141","product":{"name":"open-webSearch","vendor":{"name":"Aas-ee"}},"product_version":"\u003c 2.1.7"}],"vulnerabilityVendor":[{"id":"87a99e70-d174-3497-9c75-c2afd15ebb47","vendor":{"name":"Aas-ee"}}]}},{"id":"f0c7af0a-a8fa-3e3f-8847-de3ed9997e83","vulnerability":{"id":"GHSA-v228-72c7-fx8j","description":"open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`","datePublished":"May 5, 2026, 8:51:45 PM","dateUpdated":"May 13, 2026, 4:24:33 PM","baseScore":0.0,"references":"https://github.com/Aas-ee/open-webSearch/security/advisories/GHSA-v228-72c7-fx8j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42260\nhttps://github.com/Aas-ee/open-webSearch\n","enisa_id":"EUVD-2026-29478\n","aliases":"GHSA-v228-72c7-fx8j\nCVE-2026-42260\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}