Security issue reported in @aborruso/ckan-mcp-server
The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage.
What happened
- ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "" (out)Security Advisory GHSA-vqff-r82h-9crc
- The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''.Advisory description (GHSA-vqff-r82h-9crc)
Contributing factors stated by the source
- The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''.
The failure pattern
Watch the pattern: AI action exceeds its intended scope
Related standards
CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.
- ASI02 Tool Misuse and Exploitation
- ASI03 Identity and Privilege Abuse
- ASI10 Rogue Agents
- LLM03 Excessive Agency
- LLM10 Improper Output Handling
- AC-6 Least Privilege
- SI-10 Information Input Validation
- MAP 5.1 Estimate impacts from past uses and public incident reports
- CWE-250 Execution with Unnecessary Privileges
Building something similar?
Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.
Incidents with the same pattern
AI coding agent deletes a live production database during a code freeze (Replit, 2025)
An AI coding agent deleted a live production database that held data on more than 1,200 executives and over 1,190 companies.
Airline held liable when its website chatbot gave wrong bereavement-fare advice (Moffatt v. Air Canada, 2024)
A customer relied on Air Canada's website chatbot, which told him he could apply for a bereavement fare retroactively; the airline's policy did not allow that.
Security issue reported in Software component
The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.
Software component issue could run attacker-controlled scripts in a browser
Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollback values can execute shell commands on deploy hosts as the SSH user and on the…
Security issue reported in Software component
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before…
Security issue reported in Software component
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the…