npmPackage

mcp-searxng

4 known vulnerabilities (2 high, 2 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-58483High 7.5
mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
Affected: fixed in 1.7.1.
Fixed in 1.7.1 (released Jun 18, 2026, 89 days before disclosure).
The latest release, 2.10.0, is not affected.
18% of mcp-searxng downloads last week were affected versions (3K).
CVE-2026-58485High 7.1
mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`
Affected: fixed in 1.7.1.
Fixed in 1.7.1 (released Jun 18, 2026, 89 days before disclosure).
The latest release, 2.10.0, is not affected.
18% of mcp-searxng downloads last week were affected versions (3K).
CVE-2026-54688Medium 6.5
mcp-searxng: SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)
Affected: fixed in 1.2.1.
Fixed in 1.2.1 (released Jun 7, 2026, 100 days before disclosure).
The latest release, 2.10.0, is not affected.
17% of mcp-searxng downloads last week were affected versions (3K).
CVE-2026-54689Medium 6.3
mcp-searxng hardened-mode SSRF bypasses permit internal URL access
Affected: fixed in 1.2.1.
Fixed in 1.2.1 (released Jun 7, 2026, 100 days before disclosure).
The latest release, 2.10.0, is not affected.
17% of mcp-searxng downloads last week were affected versions (3K).