CVE-2026-19984

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-19984

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19984.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-19984

Published

2026-08-17T04:45:09Z

Modified

2026-08-22T03:31:10Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

jkawamoto mcp-florence2 __init__.py get_images server-side request forgery

Details

A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/init.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: "For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code."

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19984.json"
}

References

Affected packages

Git / github.com/jkawamoto/mcp-florence2

Affected ranges

Type

GIT

Repo

https://github.com/jkawamoto/mcp-florence2

Events

Introduced

77b0bfb8668b0795b9c0e8118fc4e6e3ea61f3e0

Last Affected

e8dd4e908e89588eb838aa036d8b564d0e39b8c6

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0.3.0"
        },
        {
            "last_affected": "0.3.0"
        },
        {
            "introduced": "0.3.1"
        },
        {
            "last_affected": "0.3.1"
        },
        {
            "introduced": "0.3.2"
        },
        {
            "last_affected": "0.3.2"
        },
        {
            "introduced": "0.3.3"
        },
        {
            "last_affected": "0.3.3"
        },
        {
            "introduced": "0.3.4"
        },
        {
            "last_affected": "0.3.4"
        },
        {
            "introduced": "0.3.5"
        },
        {
            "last_affected": "0.3.5"
        },
        {
            "introduced": "0.3.6"
        },
        {
            "last_affected": "0.3.6"
        },
        {
            "introduced": "0.3.7"
        },
        {
            "last_affected": "0.3.7"
        },
        {
            "introduced": "0.3.8"
        },
        {
            "last_affected": "0.3.8"
        },
        {
            "introduced": "0.3.9"
        },
        {
            "last_affected": "0.3.9"
        },
        {
            "introduced": "0.3.10"
        },
        {
            "last_affected": "0.3.10"
        },
        {
            "introduced": "0.3.11"
        },
        {
            "last_affected": "0.3.11"
        },
        {
            "introduced": "0.3.12"
        },
        {
            "last_affected": "0.3.12"
        },
        {
            "introduced": "0.3.13"
        },
        {
            "last_affected": "0.3.13"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*

0.3.0

0.3.1

0.3.10

0.3.11

0.3.12

0.3.13

0.3.2

0.3.3

0.3.4

0.3.5

0.3.6

0.3.7

0.3.8

0.3.9

v0.*

v0.3.0

v0.3.1

v0.3.10

v0.3.11

v0.3.12

v0.3.13

v0.3.2

v0.3.3

v0.3.4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19984.json"