npmPackage

mcp-sanitizer

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

GHSA-4MFG-R38W-W8FGHigh
mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released Jun 25, 2026, 125 days before disclosure).
The latest release, 1.4.3, is not affected.
33% of mcp-sanitizer downloads last week were affected versions (316).
GHSA-7W82-6F9J-V9JPHigh
mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths
Affected: fixed in 1.4.0.
Fixed in 1.4.0 (released Jun 25, 2026, 125 days before disclosure).
The latest release, 1.4.3, is not affected.
33% of mcp-sanitizer downloads last week were affected versions (316).