@zereight/mcp-gitlab
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- npm
- Vulnerability status
- 4 advisory(ies) without a verdict
Advisories (4)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-2h44-8472-frjj @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | 0.0.1 – < 2.1.27 | Undetermined |
| GHSA-5648-rgj9-v224 @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS | < 2.1.30 | Undetermined |
| GHSA-cv3r-c5h8-f4g5 @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover | < 2.1.27 | Undetermined |
| GHSA-vmp7-252j-cwp7 @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport | < 2.1.30 | Undetermined |
Sources
| Source | Licence |
|---|