CVE-2026-5323

A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack must be initiated from a local position. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Upgrading to version 1.0.6 is able to resolve this issue. The patch is identified as e3e11c9e8482bd06b82fd9fced67be4856f0dffc. It is recommended to upgrade the affected component. The vendor acknowledged the issue but provides additional context for the CVSS rating: "a11y-mcp is a local stdio MCP server - it has no HTTP endpoint and is not network-accessible. The caller is always the local user or an LLM acting on their behalf with user approval."

• CWE-918

• https://github.com/priyankark/a11y-mcp/
• https://github.com/priyankark/a11y-mcp/commit/e3e11c9e8482bd06b82fd9fced67be4856f0dffc
• https://github.com/wing3e/public_exp/issues/17
• https://vuldb.com/submit/780752
• https://vuldb.com/vuln/354655
• https://vuldb.com/vuln/354655/cti

Published

Apr 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53224In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-53225In the Linux kernel, the following vulnerability has been re…9.1
• CVE-2026-53226In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53227In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53228In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-53229In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-53230In the Linux kernel, the following vulnerability has been re…8.7
• CVE-2026-53231In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53232In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53233In the Linux kernel, the following vulnerability has been re…
• CVE-2026-53234In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53235In the Linux kernel, the following vulnerability has been re…7.5