Skip to content

Product

npm hackmd-mcp vulnerabilities

1 published CVE affecting npm hackmd-mcp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest npm hackmd-mcp CVEs

Newest publication first

  1. CVE-2025-59155 hackmd-mcp server-side request forgery in HTTP transport mode

    Published
    MediumCVSS 6.9 EPSS 0.36%

    hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4.0 to before 1.5.0, hackmd-mcp contains a server-side request forgery (SSRF) vulnerability when the server is run in HTTP transport mode. Arbitrary hackmdApiUrl...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.