@zereight/mcp-gitlab vulnerabilities (npm)
4 vulnerabilities.
-
@zereight/mcp-gitlabnpm @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover 9.8 Critical -
@zereight/mcp-gitlabnpm @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery 9.6 Critical -
@zereight/mcp-gitlabnpm @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport 9.6 Critical -
@zereight/mcp-gitlabnpm @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS 8.1 High