HIGH8.2npm
GHSA-v228-72c7-fx8j· CVE-2026-42260open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass `isPrivateOrLocalHostname`
Modified: 5/13/2026
package
npm/open-websearch
pkg:npm/open-websearch