Security Findings

Live

Real vulnerabilities discovered in AI packages — filter by severity, inspect evidence, and prioritize what to fix first.

Critical 31High 89Medium 146Low 82

0Findings

0Packages

Severity

Type

348 results

figma-context-mcp

Command injection via unsanitized API key in curl fallback

$src/utils/fetch-with-retry.ts:45

Path validation bypass via startsWith without trailing separator

Internal directory paths exposed in error messages

Home directory expansion may bypass allowed directory restrictions

URL command injection via open() with external OAuth authorization URL

$src/lib/node-oauth-client-provider.ts:133

figma-context-mcp

Path validation bypass via startsWith without trailing separator

$src/services/figma.ts:146

Command injection via OAuth authorization URL passed to open()

$src/lib/node-oauth-client-provider.ts:146

Path prefix validation bypass via startsWith() without trailing separator

chrome-devtools-mcp

Option to accept insecure TLS certificates

$src/cli.ts:249

chrome-devtools-mcp

Error messages from log file writing exposed to console

$src/logger.ts:20

chrome-devtools-mcp

Uncaught promise rejections logged to console without safeguards

$src/main.ts:25

chrome-devtools-mcp

Path traversal in temporary file creation

$src/McpContext.ts:813

chrome-devtools-mcp

Arbitrary Chrome extension installation

$src/McpContext.ts:904

chrome-devtools-mcp

Unverified external binary download in CI

$.github/workflows/publish-to-npm-on-tag.yml:64

figma-context-mcp

Path traversal mitigation in downloadImages is bypassable on Windows

$src/services/figma.ts:133

MD5 hash used for server URL session isolation

$src/lib/utils.ts:601

Allow-HTTP flag permits cleartext connections to non-localhost servers

$src/lib/utils.ts:478

terraform-mcp-server

Unverified external binary download and execution in CI workflow

$.github/workflows/publish-registry.yml:48

terraform-mcp-server

Unpinned dependencies in go.mod

chrome-devtools-mcp

Unsanitized user input in file save paths leads to path traversal

$src/McpResponse.ts:126

chrome-devtools-mcp

Potential exposure of system paths in error messages

$src/McpContext.ts:888

chrome-devtools-mcp

Arbitrary file write due to unsanitized user-controlled file paths

$src/McpContext.ts:898

chrome-devtools-mcp

Usage statistics collected and sent to Google by default without explicit opt-in

$src/cli.ts:213

chrome-devtools-mcp

Option to disable TLS certificate verification exposed as CLI flag

$src/cli.ts:170