GHSA-g5cg-6c7v-mmpw
HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
Blast Radius
Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.
hackmd-mcpnpmDescription
Impact
A Server-Side Request Forgery (SSRF) vulnerability that affects all users running the HackMD MCP server in HTTP mode. Attackers could exploit this vulnerability by passing arbitrary hackmdApiUrl values through HTTP headers (Hackmd-Api-Url) or base64-encoded JSON query parameters. This allows malicious users to:
- Redirect API calls to internal network services
- Potentially access sensitive internal endpoints
- Perform network reconnaissance through the server
- Bypass network access controls
The vulnerability affects the HTTP transport mode specifically - stdio mode is not impacted as it only accepts requests from stdio.
Patches
The vulnerability has been patched in version 1.5.0. Users should:
- Update to the latest version of the HackMD MCP server
- Set the
ALLOWED_HACKMD_API_URLSenvironment variable to restrict allowed HackMD API endpoints - If not set, the server will default to only allowing the official HackMD API URL (
https://api.hackmd.io/v1)
Example configuration:
ALLOWED_HACKMD_API_URLS=https://api.hackmd.io/v1,https://your-hackmd-instance.com/api/v1
Workarounds
Users can mitigate this vulnerability without upgrading by:
- Use stdio mode instead of HTTP mode: Set
TRANSPORT=stdioor remove theTRANSPORTenvironment variable to disable HTTP mode entirely - Network-level restrictions: Use firewall rules or network policies to restrict outbound connections from the server
- Reverse proxy filtering: Place the MCP server behind a reverse proxy that validates and filters both the
Hackmd-Api-Urlheader and the base64-encoded JSONconfigquery parameter to prevent malicioushackmdApiUrlvalues
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | hackmd-mcp | ≥ 1.4.0&&< 1.5.0 | 1.5.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hackmd-mcp. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update hackmd-mcp to 1.5.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-g5cg-6c7v-mmpw is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-g5cg-6c7v-mmpw is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-g5cg-6c7v-mmpw. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-g5cg-6c7v-mmpw in your dependencies?
O3 detects GHSA-g5cg-6c7v-mmpw across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.