Threats tagged 'ghsa-q344-5v34-gm84'

The @sylphx/pdf-reader-mcp package, when run as an HTTP server with MCP_TRANSPORT=http, fails to enforce API key authentication despite logging that it does. This allows unauthenticated access to the /mcp endpoint, enabling any client able to reach the server to invoke PDF processing tools and read any accessible PDF files on the host. The default binding to all interfaces (0.0.0.0) increases exposure risk. This vulnerability affects versions >=2.2.0 and <3.0.1 and is fixed in version 3.0.1.