CVE-2026-39885: 
JavaScript vulnerability analysis and mitigation

CVE-2026-39885 is a Server-Side Request Forgery (SSRF) vulnerability in the mcp-from-openapi library, part of the FrontMCP TypeScript-first framework for the Model Context Protocol (MCP). The flaw allows unauthenticated attackers to cause the server to fetch arbitrary internal or external resources by supplying a malicious OpenAPI specification containing crafted $ref pointers. Affected packages include mcp-from-openapi (versions ≤ 2.1.2), frontmcp, @frontmcp/sdk, and @frontmcp/adapters (all versions ≤ 1.0.3). The vulnerability was published on April 8, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause (CWE-918) lies in index.js (lines 870–875) of mcp-from-openapi, where OpenAPIToolGenerator.initialize() calls @apidevtools/json-schema-ref-parser's .dereference() method without any URL allowlist, custom resolvers, or protocol restrictions (GitHub Advisory). By default, the ref parser fetches any URL encountered in $ref values — including http://, https://, and file:// URIs — during the initialization call. An attacker only needs to supply a crafted OpenAPI specification (no authentication required) containing $ref values pointing to internal addresses (e.g., http://169.254.169.254/latest/meta-data/) or local files (e.g., file:///etc/passwd). A public proof-of-concept demonstrating the SSRF trigger via a standalone JavaScript script is available in the security advisory (GitHub Advisory).

Successful exploitation enables an unauthenticated attacker to perform SSRF to internal network services, probe internal ports, read cloud instance metadata (e.g., AWS IAM credentials from http://169.254.169.254/), and read arbitrary local files via the file:// protocol — all with high confidentiality impact and no integrity or availability impact (GitHub Advisory). In cloud-hosted environments, this could lead to theft of IAM credentials, enabling lateral movement to other cloud resources. Any application that processes untrusted OpenAPI specifications using this library is at risk.

A functional proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of a standalone JavaScript script that triggers an actual HTTP request to an attacker-controlled server during initialize() — confirmed on mcp-from-openapi v2.1.2 (GitHub Advisory). No privileges or user interaction are required for exploitation. There is no current evidence of in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.032% (low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Craft a malicious OpenAPI specification: Create a JSON or YAML OpenAPI spec containing a $ref value pointing to a target resource, such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata) or file:///etc/passwd (local file read).
2. Supply the spec to the target application: Deliver the malicious OpenAPI spec to any application that uses mcp-from-openapi to process OpenAPI documents — this requires no authentication, only the ability to provide input to the spec loader.
3. Trigger initialization: The vulnerable application calls OpenAPIToolGenerator.initialize(), which internally invokes $RefParser.dereference() without URL restrictions, causing the server to fetch the attacker-specified URL.
4. Collect exfiltrated data: For SSRF to cloud metadata, the server's HTTP request to 169.254.169.254 returns IAM credentials or other metadata. For local file reads, the file contents are included in the dereferenced output returned to the caller. For internal network scanning, observe whether the request succeeds or times out to infer port/service availability (GitHub Advisory).

• Network: Outbound HTTP/HTTPS requests from the Node.js application server to 169.254.169.254 (AWS/GCP/Azure metadata endpoints) or other internal RFC-1918 addresses; unexpected outbound connections to unknown external IPs during OpenAPI spec processing.
• Logs: Application logs showing $ref resolution errors or unexpected HTTP fetches to internal addresses during initialize() calls; Node.js process network activity logs showing connections to metadata endpoints or internal services.
• File System: Evidence of file:// URI resolution in application output or error logs, potentially exposing contents of /etc/passwd, /etc/shadow, or other sensitive files.
• Process: Unusual network activity originating from the Node.js process handling OpenAPI specifications, particularly to cloud metadata IPs or internal subnets not normally accessed by the application (GitHub Advisory).

Upgrade mcp-from-openapi to version 2.3.0 or later, and upgrade frontmcp, @frontmcp/sdk, and @frontmcp/adapters to version 1.0.4 or later — these releases introduce a refResolution option to configure and restrict $ref resolution, preventing SSRF (GitHub Release). As a workaround prior to patching, pass resolver options to .dereference() that disable file://, http://, and https:// protocols, or implement an allowlist of trusted hosts. Additionally, restrict which OpenAPI specifications the application will process to trusted, internally-controlled sources only, and consider network segmentation to prevent the application server from reaching cloud metadata endpoints (GitHub Advisory).

The vulnerability was responsibly disclosed by researcher @TharVid via GitHub Security Advisory, and the FrontMCP maintainers acknowledged and credited the reporter in the v1.0.4 release notes (GitHub Release). Social media activity was limited, with brief mentions on Mastodon and Bluesky shortly after disclosure. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.