CVE-2026-5323: 
JavaScript vulnerability analysis and mitigation

CVE-2026-5323 is a Server-Side Request Forgery (SSRF) vulnerability in the A11yServer function of priyankark/a11y-mcp, an MCP (Model Context Protocol) server for accessibility auditing. It affects versions up to and including 1.0.5 of the npm package a11y-mcp. The vulnerability was discovered by independent researcher Winegee (Zhejiang University) via static analysis on March 15, 2026, and publicly disclosed on April 2, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 4.8 (Medium); the vendor notes the actual risk is lower given the tool's local-only, stdio-based architecture (Github Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery): the audit_webpage and get_summary MCP tool handlers in src/index.js pass attacker-controlled url arguments directly to Puppeteer's page.goto() without any URL validation or allowlisting. Specifically, the data flows from the MCP JSON-RPC request parameter at src/index.js:83 to the Puppeteer navigation sink at lines 117 and 205 (await page.goto(args.url, { waitUntil: 'networkidle2', timeout: 30000 })). An attacker who can invoke these MCP tool handlers can cause the server to initiate HTTP requests to arbitrary destinations, including loopback addresses, RFC1918 private ranges, link-local addresses, and cloud metadata endpoints (e.g., 169.254.169.254). The attack requires local access and low privileges — the caller must be the local user or an LLM agent acting on their behalf (Public PoC, Patch Commit).

A local attacker with low privileges can cause the a11y-mcp server to issue HTTP requests to internal network resources, cloud metadata endpoints, or other services reachable from the host, potentially exposing sensitive configuration data or credentials. Confidentiality, integrity, and availability impacts are each rated Low in the official scoring, reflecting the constrained local attack surface. In environments where the tool is integrated with LLM agents, a compromised or malicious LLM prompt could abuse this vulnerability to probe internal infrastructure without direct user awareness (Github Advisory, Feedly).

A proof-of-concept MCP JSON-RPC request has been publicly disclosed in the GitHub issue tracker, demonstrating SSRF via the audit_webpage tool with a crafted internal URL. The EPSS score is approximately 0.012% (very low probability of exploitation in the next 30 days), and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog. The vulnerability was discovered through static analysis (CodeQL) and no dynamic exploit replay was performed by the reporter (Public PoC, Github Advisory).

1. Identify target: Confirm the target system is running a11y-mcp version ≤ 1.0.5 and that you have local access or can interact with an LLM agent configured to use the MCP server.
2. Craft MCP JSON-RPC request: Construct a JSON-RPC 2.0 request targeting the audit_webpage or get_summary tool with an attacker-controlled internal URL, for example:

{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"audit_webpage","arguments":{"url":"http://169.254.169.254/latest/meta-data/"}}}

3. Send request via stdio: Deliver the crafted request through the MCP stdio transport (e.g., pipe it to the running a11y-mcp process or via the configured MCP client).
4. Observe SSRF: The Puppeteer browser instance navigates to the attacker-specified URL; responses from internal services or metadata endpoints may be reflected in the tool's output or observable via a listener on the attacker-controlled destination.
5. Enumerate internal resources: Repeat with different internal addresses (RFC1918 ranges, loopback, cloud metadata) to map accessible services and extract sensitive data (Public PoC).

• Network: Outbound HTTP requests from the host running a11y-mcp to internal RFC1918 addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x), loopback (127.0.0.1), link-local (169.254.x.x), or cloud metadata endpoints (e.g., 169.254.169.254) originating from a Puppeteer/Chromium process.
• Process: Unexpected Chromium/Puppeteer child processes spawned by the a11y-mcp Node.js process making connections to internal network destinations rather than public web URLs.
• Logs: MCP tool invocations of audit_webpage or get_summary with url parameters pointing to internal or non-public addresses in application or MCP client logs.

Upgrade a11y-mcp to version 1.0.6 or later, which introduces URL validation in the validateUrl() function that blocks loopback, RFC1918 private ranges, link-local, and cloud metadata addresses after DNS resolution, and restricts schemes to http and https only (patch commit e3e11c9e8482bd06b82fd9fced67be4856f0dffc). As a workaround prior to patching, restrict local system access to authorized users only and ensure LLM agent integrations enforce strict user approval workflows before invoking MCP tools. Network-level egress filtering to block outbound connections from the host to internal address ranges can also reduce exposure (Patch Commit, Github Advisory).

The vendor (priyankark) acknowledged the vulnerability but provided context disputing the severity rating, noting that a11y-mcp is a local stdio MCP server with no HTTP endpoint and is not network-accessible, and that callers are always the local user or an LLM acting with user approval. A Bluesky post referencing the issue was observed in the days following disclosure, indicating minor community awareness. No significant media coverage or broader security community commentary has been identified (Github Advisory, Feedly).