Detections
Analytics

SCA: security update for hackmd-mcp (GHSA-g5cg-6c7v-mmpw)

medium Tenable Self-Hosted Container Security Plugin ID 435313

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI
 assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery (SSRF)
 vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl values supplied via
 the Hackmd-Api-Url HTTP header or a base64-encoded JSON query parameter are accepted without validation,
 allowing attackers to redirect outbound API requests to internal network services, access internal
 endpoints, perform network reconnaissance, and bypass network access controls. The stdio transport mode is
 not affected because it only accepts stdio requests. The issue is fixed in version 1.5.0, which enforces
 allowed endpoints and supports the ALLOWED_HACKMD_API_URLS environment variable. Users should update to
 1.5.0 or later or apply documented mitigations such as switching to stdio mode, restricting outbound
 network access, or filtering the Hackmd-Api-Url header and related query parameter via a reverse proxy.
 (CVE-2025-59155)

See Also

https://github.com/advisories/GHSA-g5cg-6c7v-mmpw

Plugin Details

Severity: Medium

ID: 435313

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 9/16/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.46

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2025-59155

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 9/15/2025

Reference Information

CVE: CVE-2025-59155

cwe: CWE-918