Description

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted the environment-variable form of the same setting to the vendor's own hosts over HTTPS. Because the connect path in src/mcp.ts attaches the stored token as a bearer credential on every request to the configured endpoint, a user who was persuaded to run configure with an endpoint of the attacker's choosing sent their personal access token to that destination on each subsequent invocation. Version 0.2.5 applies the same helper to the option.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-27T17:20:52.773Z",
  "pubdate": "2026-08-27T17:20:52.773Z",
  "executiveSummary": "A critical security vulnerability exists within the configuration logic of the application, where improper input sanitization of endpoint URLs facilitates the exfiltration of sensitive bearer tokens.\nThe vulnerability is classified as an improper input validation flaw, resulting in an unauthorized credential disclosure. By persuading a user to execute the configuration command with a malicious endpoint, an attacker can capture personal access tokens.\nAffected systems include versions prior to 0.2.5. The impact is high, as the exposure of these credentials allows an attacker to impersonate the user and access authenticated services associated with the token.\nExploitation requires social engineering or local interaction to convince the user to run the configured command pointing to an attacker-controlled server. There are no complex network requirements beyond the ability to host a receiver for the outgoing HTTP requests.\nThis vulnerability highlights a failure in enforcing consistent security policies across different configuration methods, as the command-line interface bypassed the existing validation logic used for environment variables.",
  "technicalDetails": "The root cause of this vulnerability is the inconsistent application of security validation logic within the configuration subsystem. Specifically, the ConfigureCommand.execute function located in src/cli.ts accepted arbitrary user-provided endpoint URLs and persisted them to the user configuration file without validation.\nThe application relies on a helper function, createSafeUrl in src/config.ts, to enforce strict endpoint restrictions—limiting URLs to authorized vendor hosts and mandating the HTTPS protocol. While this helper was correctly utilized for environment-variable-based configurations, it was omitted in the implementation of the command-line interface.\nThe exploitation flow proceeds as follows: First, an attacker induces the user to execute the configuration command with an attacker-controlled endpoint URL. Because the input lacks sanitization, the application writes this malicious URL directly into the user profile. Second, the vulnerable component in src/mcp.ts, which manages connection logic, reads this stored URL during subsequent executions.\nThe technical mechanism for exfiltration is embedded within the connect path in src/mcp.ts. Upon invocation, the system retrieves the stored user access token and automatically attaches it to the request header as a Bearer credential. This request is then transmitted to the attacker-supplied endpoint.\nBy capturing the incoming request on a server under their control, the attacker retrieves the Bearer token from the HTTP Authorization header. This provides the attacker with persistent access to the victim's credentials, which can then be used to gain unauthorized access to any resources protected by that specific access token.\nThe vulnerability affects versions prior to 0.2.5. Version 0.2.5 remediates the issue by explicitly applying the createSafeUrl helper function to the input provided via the CLI option, ensuring that the command-line configuration adheres to the same domain and protocol restrictions enforced elsewhere in the application architecture."
}