CVE-2026-15750

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-15750
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15750.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-15750
Published
2026-07-14T21:30:08Z
Modified
2026-08-12T03:51:15Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery
Details

A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15750.json"
}
References

Affected packages

Git / github.com/mastergo-design/mastergo-magic-mcp

Affected ranges

Type
GIT
Repo
https://github.com/mastergo-design/mastergo-magic-mcp
Events
Introduced
7c7f2e161183608e7f50f51a4bfb7487de22ceca
Last Affected
189a1d01dbb2e03428179089a682d1d2f527bdb0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1"
        },
        {
            "last_affected": "0.1"
        },
        {
            "introduced": "0.2.0"
        },
        {
            "last_affected": "0.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1
0.2.0
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.4
v0.1.5
v0.1.6
v0.1.6-beta.0
v0.1.6-beta.1
v0.1.6-beta.2
v0.1.6-beta.3
v0.1.6-beta.4
v0.1.7
v0.1.7-beta.0
v0.1.8
v0.1.9-alpha.0
v0.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15750.json"