package

npm/@samanhappy/mcphub

pkg:npm/%40samanhappy/mcphub

LOWnpm

MCPHub's ServerController is vulnerable to Command Injection

Modified: 10/9/2025

MEDIUMnpm

MCPHub has an authentication bypass

Modified: 4/15/2026

HIGHnpm

MCPHub has Path Traversal via Malicious MCPB Manifest Name

Modified: 9/1/2026

MEDIUMnpm

MCPHub has an Improper Authorization vulnerability via its handleSseConnection function

Modified: 10/9/2025

CRITICAL9.1npm

@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation

Modified: 5/14/2026