CVE-2026-15750mediumCWE-918

CVE-2026-15750: medium-severity vulnerability in mastergo-design mastergo-magic-mcp

mastergo-design mastergo-magic-mcp mcp__getComponentLink get-component-link.ts z.string server-side request forgery

Published · Updated

Follow this CVE+ Monitor mastergo-magic-mcp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.4%
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcp__getComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
mastergo-design · mastergo-magic-mcp
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — mastergo-design mastergo-magic-mcp

In the same product, most dangerous first.

CVE-2026-15751MEDIUMmastergo-design mastergo-magic-mcp mcp__getComponentGenerator component-workflow.md execute path traversalEPSS 0.2%CVE-2026-15749MEDIUMmastergo-design mastergo-magic-mcp mcp__C2d get-c2d.ts execute path traversalEPSS 0.2%