VulnerableCode Package Details - pkg:npm/%40samanhappy/mcphub@0.0.20

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:npm/%40samanhappy/mcphub@0.0.20

Essentials

purl	pkg:npm/%40samanhappy/mcphub@0.0.20

Next non-vulnerable version	0.12.15
Latest non-vulnerable version	0.12.15
Risk score	4.1

Vulnerabilities affecting this package (5)

Advisory	Summary	Fixed in package version
GHSA-5q2p-3jg8-2m98 Aliases: CVE-2025-11285	MCPHub's ServerController is vulnerable to Command Injection A vulnerability was found in samanhappy MCPHub up to 0.9.10. Affected by this …	There are no reported fixed by versions.
GHSA-v7c4-33vf-cqqq Aliases: CVE-2025-11287	MCPHub has an Improper Authorization vulnerability via its handleSseConnection function A vulnerability was identified in samanhappy MCPHub up to 0.9.10. …	There are no reported fixed by versions.
GHSA-9vq7-9h42-j88h Aliases: CVE-2025-13822	MCPHub has an authentication bypass MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected …	0.11.0 Vulnerable
GHSA-p3h2-2j4p-p83g	MCPHub has Path Traversal via Malicious MCPB Manifest Name MCPB File Upload Handler extracts a ZIP file and reads `manifest.json` …	0.12.13 Vulnerable
GHSA-wf8q-wvv8-p8jf	@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation ### Summary A critical identity spoofing …	0.12.15 Not vulnerable

This package is not known to fix any advisories.