Detections
Analytics

SCA: security update for a11y-mcp (GHSA-prmx-7v35-7q82)

medium Tenable Self-Hosted Container Security Plugin ID 439848

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability was found in priyankark a11y-mcp up to 1.0.5. This vulnerability affects the function
 A11yServer of the file src/index.js. The manipulation results in server-side request forgery. The attack
 must be initiated from a local position. The exploit has been made public and could be used. This product
 operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version
 details for either affected or updated releases. Upgrading to version 1.0.6 is able to resolve this issue.
 The patch is identified as e3e11c9e8482bd06b82fd9fced67be4856f0dffc. It is recommended to upgrade the
 affected component. The vendor acknowledged the issue but provides additional context for the CVSS rating:
 "a11y-mcp is a local stdio MCP server - it has no HTTP endpoint and is not network-accessible. The caller
 is always the local user or an LLM acting on their behalf with user approval." (CVE-2026-5323)

Solution

Update the a11y-mcp library and its related packages to version 1.0.5 or later.

See Also

https://github.com/advisories/GHSA-prmx-7v35-7q82

Plugin Details

Severity: Medium

ID: 439848

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 4/4/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.8

Percentile: 22.6

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2026-5323

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 4.8

Threat Score: 1.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 4/2/2026

Vulnerability Publication Date: 4/2/2026

Reference Information

CVE: CVE-2026-5323

cwe: CWE-918