@contentful vulnerabilities

Products

• contentful-mcp-server 1
• mcp-server 1
• mcp-tools 1
• python example 1

Latest @contentful CVEs

Newest publication first

1. CVE-2026-53957 Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint

   Published 2026-09-15

   High·CVSS 7.7 EPSS 0.42%

   Contentful MCP Server is a Model Context Protocol server for the Contentful Management API. Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts and packa...

2. CVE-2020-13258 Cross-site scripting in Contentful

   Published 2020-05-21

   Medium·CVSS 6.1 EPSS 2.1%

   Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.