GHSA-fvh2-gm75-j4j7
HIGHGHSA-fvh2-gm75-j4j7 is a high-severity (CVSS 7.5) CWE-346 vulnerability in dynoxide-rs. O3 Security confirms whether GHSA-fvh2-gm75-j4j7 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport
Exploitation Status
No confirmed exploitation observed yet
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-fvh2-gm75-j4j7.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-fvh2-gm75-j4j7 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 0 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
dynoxide-rs📦dynoxideReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io, npm packages — download data is not available via public APIs for these ecosystems.
Description
Summary
dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive rmcp dependency, plus a related cross-origin CSRF gap. A malicious web page could make the user's browser send requests to a local dynoxide mcp --http or dynoxide serve --mcp server with a non-loopback Host header, which the server would then process. Affects 0.9.3 to 0.9.12. The stdio transport (dynoxide mcp without --http, which is the default) is not affected.
Impact
If a user is running dynoxide mcp --http (or dynoxide serve --mcp) on their machine and then visits a malicious web page, the attacker's JavaScript can call any MCP tool exposed by the running dynoxide instance.
Reachable tools include reads (get_item, query, scan, batch_get_item, describe_table, list_tables) and writes (put_item, update_item, delete_item, create_table, batch_write_item).
Any data in tables that the local dynoxide instance has access to can be read, modified, or destroyed.
Patches
dynoxide 0.9.13 closes both the named CVE and a related cross-origin CSRF gap:
-
DNS rebinding (the named CVE).
rmcpis upgraded from 1.1.1 to 1.6.0. rmcp 1.4+ ships a default Host-header allowlist (["localhost", "127.0.0.1", "::1"]) which rejects requests carrying any other Host header with a 403. -
Defence in depth. Explicit
allowed_hostsandallowed_originslists are now set onStreamableHttpServerConfigdirectly. The Host allowlist protects against a future rmcp default flip. The Origin allowlist closes a related cross-origin CSRF gap that the Host check alone does not address: a malicious page couldfetchthe loopback endpoint withmode: 'no-cors', the Host header would match (it's the literal loopback address the browser is connecting to), but the Origin header would otherwise have been unchecked.
Native MCP clients that don't send an Origin header (Claude Code, Cursor, the dynoxide CLI) are unaffected by the Origin check and continue to work.
Workarounds
- Upgrade to dynoxide 0.9.13.
- If upgrade is not immediately possible: do not run the MCP HTTP transport. Run
dynoxide mcp(stdio, the default) instead ofdynoxide mcp --http, and don't pass--mcptodynoxide serve.
Resources
- Upstream rmcp advisory: GHSA-89vp-x53w-74fx
- Upstream CVE: CVE-2026-42559
- dynoxide release: v0.9.13
- MCP transport security guidance: https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#security-warning
Credits
Vulnerability identified via GitHub Dependabot alert on the transitive rmcp dependency.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | dynoxide-rs | ≥ 0.9.3&&< 0.9.13 | 0.9.13 |
| 📦npm | dynoxide | ≥ 0.9.3&&< 0.9.13 | 0.9.13 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for dynoxide-rs. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update dynoxide-rs to 0.9.13 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-fvh2-gm75-j4j7 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-fvh2-gm75-j4j7 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-fvh2-gm75-j4j7. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-fvh2-gm75-j4j7 in your dependencies?
O3 detects GHSA-fvh2-gm75-j4j7 across crates.io, npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.