[GHSA-hhfx-wfvq-7g9c] Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network#7151
Conversation
github-actions
bot
changed the base branch from
main
to
vcolin7/advisory-improvement-7151
There was a problem hiding this comment.
Pull request overview
Updates the GHSA advisory metadata for Azure MCP Server SSRF to include affected versions published via npm and PyPI.
Changes:
- Adds new
affectedentries for the npm package@azure/mcpacross stable and beta ranges - Adds a new
affectedentry for the PyPI packagemsmcp-azure - Bumps the advisory
modifiedtimestamp
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "@azure/mcp" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "2.0.0-beta.1" | ||
| }, | ||
| { | ||
| "fixed": "2.0.0-beta.17" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, | ||
| { | ||
| "package": { | ||
| "ecosystem": "npm", | ||
| "name": "@azure/mcp" | ||
| }, | ||
| "ranges": [ | ||
| { | ||
| "type": "ECOSYSTEM", | ||
| "events": [ | ||
| { | ||
| "introduced": "1.0.0" | ||
| }, | ||
| { | ||
| "fixed": "1.0.2" | ||
| } | ||
| ] | ||
| } | ||
| ] | ||
| }, |
There was a problem hiding this comment.
There are two separate affected entries for the same npm package (@azure/mcp). OSV tooling typically expects a single affected object per package, with multiple version ranges under its ranges array. Consider merging these into one affected entry with both ranges to avoid duplication and reduce the chance of future edits diverging.
| "introduced": "2.0.0-beta.14" | ||
| }, | ||
| { | ||
| "fixed": "2.0.0-beta.17" |
There was a problem hiding this comment.
PyPI versions are expected to follow PEP 440 normalization (e.g., beta releases generally use forms like 2.0.0b14, not 2.0.0-beta.14). If these strings don’t match the actual published PyPI versions, affected-version matching may break in downstream consumers. Please update introduced/fixed to the exact PyPI release versions as published for msmcp-azure.
| "introduced": "2.0.0-beta.14" | |
| }, | |
| { | |
| "fixed": "2.0.0-beta.17" | |
| "introduced": "2.0.0b14" | |
| }, | |
| { | |
| "fixed": "2.0.0b17" |
Updates
Comments
Affected versions of the Azure MCP Server were also published to NPM and PyPI. This update adds details for said package managers.