CVE-2026-7150 Details
Description
A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of the file src/auto_favicon/server.py of the component MCP Tool. The manipulation of the argument image_url results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
A server-side request forgery (SSRF) vulnerability has been identified in dh1011 auto-favicon version 1.0.1, specifically in the MCP Tool component. The issue arises in the 'generate_favicon_from_url' function within 'src/auto_favicon/server.py'. The vulnerability allows an untrusted caller to manipulate the 'image_url' argument, bypassing destination validation and directing the server to fetch data from internal or metadata endpoints. This exploitation can be initiated remotely, and a public proof-of-concept exploit is available.
It is recommended to implement strict URL validation in the 'generate_favicon_from_url' function, rejecting internal destinations and untrusted image hosts. Additionally, consider disabling the URL-based tool when the server is exposed to untrusted callers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 27, 2026CISA-ADP
Assessed Apr 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dh1011/auto-favicon-mcp/issues/2 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/submit/802054 | [email protected] | Issue TrackingTechnical Description |
| https://vuldb.com/vuln/359749 | [email protected] | AdvisoryExploitPartial Content |
| https://vuldb.com/vuln/359749/cti | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dh1011 auto-favicon | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 27, 2026 | New CVE Received | [email protected] |