Log in Start free

Vulnerability · Published Apr 27, 2026 · Assigned by VulDB

CVE-2026-7150dh1011 auto-favicon MCP Tool server.py generate_favicon_from_url server-side request forgery

Medium 6.3

In plain English

A medium-severity server-side request forgery in auto-favicon from dh1011. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.2%top 89.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in dh1011 auto-favicon up to f189116a9259950c2393f114dbcb94dde0ad864b. This issue affects the function generate_favicon_from_url of the file src/auto_favicon/server.py of the component MCP Tool. The manipulation of the argument image_url results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIauto-faviconno fix listedGHSA-vmh7-9c7h-2pgg
PyPIauto-faviconno fix listedPYSEC-2026-2386

Affected products (as reported)

VendorProductVersions
dh1011 auto-favicon f189116a9259950c2393f114dbcb94dde0ad864b

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References