How severe is GHSA-v52w-28xh-v562?

No CVSS score has been assigned to GHSA-v52w-28xh-v562 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by GHSA-v52w-28xh-v562?

GHSA-v52w-28xh-v562 affects the following packages: kozou (npm), @kozou/api (npm), @kozou/mcp (npm), @kozou/core (npm). Ecosystems affected: npm.

How do I fix GHSA-v52w-28xh-v562?

Update kozou to 1.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v52w-28xh-v562 is resolved across your whole dependency graph.

How do I detect GHSA-v52w-28xh-v562 in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kozou. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-v52w-28xh-v562 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-v52w-28xh-v562?

O3 pinpoints whether GHSA-v52w-28xh-v562 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-v52w-28xh-v562 actively exploited in the wild?

No public exploit code has been indexed for GHSA-v52w-28xh-v562 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-v52w-28xh-v562 published, and has it been updated?

GHSA-v52w-28xh-v562 was published on June 19, 2026 and was last updated on June 19, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦 npm

Not in CISA KEV

GHSA-v52w-28xh-v562

GHSA-v52w-28xh-v562 is a security vulnerability in kozou. O3 Security confirms whether GHSA-v52w-28xh-v562 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

Published

Jun 19, 2026

Updated

Jun 19, 2026

Affected

4 pkgs

Patched

4 / 4

Exploits

None indexed

Exploitation data as of Jun 19, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

4 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

kozounpm

26downloads / week

@kozou/apinpm

29downloads / week

@kozou/mcpnpm

43downloads / week

Description

Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in 1.8.1.

Issues

MCP HTTP server lacked DNS-rebinding protection. The Streamable HTTP transport is unauthenticated and loopback by default. Without Host/Origin validation, a malicious web page in the operator's browser could rebind a hostname it controls to the loopback address and drive the MCP endpoint — reading schema metadata, or (when the opt-in call execution tool is enabled) executing exposed functions as the execution role.
Unbounded request-body buffering (DoS). Both the MCP HTTP server and the in-house REST server read the entire request body into memory with no size limit, so a reachable client could drive the process toward memory exhaustion.
Read requests ran in a read/write transaction. The shared role-transaction envelope opened every request with a plain BEGIN, so a GET ran read/write. A SELECT that reaches a volatile function or a writable / INSTEAD-triggered view could perform a write that then commits — the "a GET only reads" contract was left to the serving role's grants rather than enforced.
No-auth dev surfaces published on all interfaces by default. The scaffolded docker-compose.yml (and the quickstart) published the unauthenticated Admin UI and MCP HTTP server — and the default-credential demo database — on every host interface, and the config defaulted those binds to 0.0.0.0.

What changed in 1.8.1

DNS-rebinding guard (MCP HTTP): the server validates the Host header (and a present Origin) against an allowlist before handling any request, on every route. Matching is on the hostname; loopback names are always accepted and an operator can add hosts via configuration. A browser cannot forge Host/Origin, so this closes the rebinding vector. (This is a browser-rebinding defence; network reachability of an unauthenticated server must still be constrained by the network — see workarounds.)
Request-body size cap: both HTTP servers reject an over-large declared Content-Length (413) and enforce the limit while streaming, so a chunked / Content-Length-less body cannot grow unbounded. A non-JSON Content-Type on a body is rejected with 415. The cap is configurable.
Read-only read transactions: read methods (GET) now run in a READ ONLY transaction, so the database refuses any write for the duration of the request regardless of the role's grants.
Loopback-by-default network posture: the Admin UI and MCP HTTP server now bind loopback by default; the bundled compose files publish every host port (Admin UI, MCP, database) on 127.0.0.1 only, while the container binds all interfaces internally so the loopback mapping still works. Operators opt into a broader bind explicitly.

Impact

The MCP HTTP server's exposure is greatest when the opt-in call execution tool is enabled and/or the server is reachable beyond loopback. The read/write-transaction issue has effect only when the schema exposes a read path that can write (a volatile-function-backed column or a writable/INSTEAD-triggered view) and the serving role holds write grants. The all-interface publish affected anyone who ran the scaffolded docker compose up on a host reachable from an untrusted network. Requests run under SET LOCAL ROLE, so PostgreSQL still enforces grants/RLS at runtime; these are defense-in-depth and read-contract hardening.

Affected / patched

npm packages kozou, @kozou/api, @kozou/mcp, @kozou/core (and the lockstep-versioned siblings): affected <= 1.8.0, patched 1.8.1.
Container image ghcr.io/kozou-dev/kozou: patched at tag v1.8.1.

Workarounds (if you cannot upgrade immediately)

Bind the Admin UI and MCP HTTP server to loopback and publish their host ports on 127.0.0.1 only; do not expose them to untrusted networks.
Do not enable the MCP call execution tool on a non-loopback / unauthenticated deployment.
Put an authenticating reverse proxy (with Host/Origin validation and a request-body limit) in front of any non-loopback deployment.
Change the demo database's default credentials and restrict its port.

Patches

Upgrade to Kozou 1.8.1 (all npm packages and the ghcr.io/kozou-dev/kozou image).

Affected Packages

4 total 4 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`kozou`	all versions	1.8.1
📦npm	`@kozou/api`	all versions	1.8.1
📦npm	`@kozou/mcp`	all versions	1.8.1
📦npm	`@kozou/core`	all versions	1.8.1

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for kozou. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update kozou to 1.8.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-v52w-28xh-v562 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-v52w-28xh-v562 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-v52w-28xh-v562. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

Kozou compiles a PostgreSQL schema into an Admin UI, a REST API, and an MCP server. Several hardening gaps in the bundled HTTP surfaces and the scaffolded dev stack are fixed in **1.8.1**. ## Issues 1. **MCP HTTP server lacked DNS-rebinding protection.** The Streamable HTTP transport is unauthenticated and loopback by default. Without `Host`/`Origin` validation, a malicious web page in the operator's browser could rebind a hostname it controls to the loopback address and drive the MCP endpoint — reading schema metadata, or (when the opt-in `call` execution tool is enabled) executing exposed

O3 Security · Impact-Aware SCA

Is GHSA-v52w-28xh-v562 in your dependencies?

O3 detects GHSA-v52w-28xh-v562 across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works