← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-45rj-2wq9-r9mr: Missing Host and Origin Header Validation in Built-in MCP HTTP Server Enables Browser-Based Remote Code Execution via DNS Rebinding (electerm/electerm)

[OFFICIALLY PUBLISHED BY VENDOR]
Officially published by upstream maintainer on 2026-11-02T08:14:08Z as GHSA-45rj-2wq9-r9mr (state: published, CVSS v3.1 8.8 HIGH) with accepted reporter credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-45rj-2wq9-r9mr",
  "repository": "electerm/electerm",
  "package": "npm:electerm",
  "vulnerable_version_range": "<= 5.8.1",
  "patched_versions": "5.8.2",
  "html_url": "https://github.com/electerm/electerm/security/advisories/GHSA-45rj-2wq9-r9mr",
  "state": "published",
  "published_at": "2026-11-02T08:14:08Z",
  "summary": "Missing Host and Origin Header Validation in Built-in MCP HTTP Server Enables Browser-Based Remote Code Execution via DNS Rebinding",
  "severity": "high",
  "cvss_v3": {
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "score": 8.8,
    "severity": "HIGH"
  },
  "cvss_v4": {
    "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
    "score": 8.6,
    "severity": "HIGH"
  },
  "status": "Officially Published by Vendor (GHSA-45rj-2wq9-r9mr) \u2022 Patched > 5.8.1",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-306",
    "CWE-346",
    "CWE-350"
  ]
}