Threats affecting pkg:npm/samanhappy/mcphub

CVE-2026-120323 is an information disclosure vulnerability in samanhappy MCPHub affecting versions up to 1.0.45 and 1.1.7. The flaw involves manipulation of the passthroughHeaders argument in the file src/utils/passthroughHeaders.ts, allowing remote attackers to disclose information. Upgrading to version 1.1.8 addresses this issue.

A path traversal vulnerability exists in the MCPHub MCPB file upload handler due to improper sanitization of the 'name' field in the uploaded manifest.json. The 'name' field is directly concatenated into file system paths without validation, allowing an attacker to craft a malicious MCPB file that causes extraction and file operations outside the intended directory. This can lead to arbitrary file creation or deletion on the server file system.