{
 "id": "AIR-2025-0481",
 "slug": "cve-2025-59155-hackmd-mcp-server-side-request-forgery-vulner",
 "title": "CVE-2025-59155: hackmd-mcp server-side request forgery vulnerability",
 "summary": "The hackmd-mcp Model Context Protocol server contains an SSRF flaw when running in HTTP transport mode due to missing input validation. Attackers can redirect outbound API requests to internal network endpoints and bypass security controls.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "hackmd-mcp"
 ],
 "incident_date": "2025-09-15",
 "incident_date_precision": "day",
 "first_reported": "2025-09-15",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59155",
   "publisher": "NVD",
   "title": "CVE-2025-59155: hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants.",
   "published_at": "2025-09-15"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2025-59155",
  "ssrf",
  "mcp-server"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}