Threats tagged 'ghsa-rmrp-j9qh-xwh9'

CVE-2026-19369 is a server-side request forgery (SSRF) vulnerability in KS-GEN-AI jira-mcp-server version 0.2.0. It affects the axios.get function in the add_attachment_from_public_url component, specifically in the src/index.ts file. The vulnerability arises from manipulation of the imageUrl argument, allowing an attacker with local access to induce the server to make unintended requests. The issue was reported early to the project, but no response or fix has been provided yet.