# CVEs & security advisories credited to Liran Tal

Browse publicly credited security disclosures by Liran Tal, including command injection, path traversal, SSRF, and MCP server vulnerabilities.

Canonical: https://lirantal.com/research/advisories

## Disclosure archive

Search disclosures

Severity All severities CriticalHighModerateLow

StatusAll recordsActiveWithdrawn

Reset filters

Showing 43 of 43 records

May 5, 2026

High severity

### [ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid ↗](https://github.com/advisories/GHSA-p4hc-9pjh-55c8)

ssrfcheck · npm

CVE-2025-8267 · GHSA-p4hc-9pjh-55c8

Nov 26, 2025

Moderate severity

### [willitmerge has a Command Injection vulnerability ↗](https://github.com/advisories/GHSA-j9wj-m24m-7jj6)

willitmerge · npm

CVE-2025-66219 · GHSA-j9wj-m24m-7jj6

Nov 5, 2025

Moderate severity

### [Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode ↗](https://github.com/advisories/GHSA-m35w-xx8c-6xc7)

doris-mcp-server · pip

CVE-2025-58337 · GHSA-m35w-xx8c-6xc7

Sep 30, 2025

Critical severity

### [check-branches is vulnerable to command Injection ↗](https://github.com/advisories/GHSA-9c4g-fp4r-prrv)

check-branches · npm

CVE-2025-11148 · GHSA-9c4g-fp4r-prrv

Sep 30, 2025

High severity

### [@nubosoftware/node-static failure to catch exception can result in server crash ↗](https://github.com/advisories/GHSA-27w5-gj5q-82fv)

@nubosoftware/node-static · npm

CVE-2025-11149 · GHSA-27w5-gj5q-82fv

Sep 24, 2025

Moderate severity

### [Mastra Docs MCP Server @mastra/mcp-docs-server Leads to Information Exposure ↗](https://github.com/advisories/GHSA-xh92-rqrq-227v)

@mastra/mcp-docs-server · npm

CVE-2025-61685 · GHSA-xh92-rqrq-227v

Sep 24, 2025

Critical severity

### [Command Injection in adb-mcp MCP Server ↗](https://github.com/advisories/GHSA-54j7-grvr-9xwg)

adb-mcp · npm

CVE-2025-59834 · GHSA-54j7-grvr-9xwg

Sep 22, 2025

High severity

### [git-comiters Command Injection vulnerability ↗](https://github.com/advisories/GHSA-g38c-wxjf-xrh6)

git-commiters · npm

CVE-2025-59831 · GHSA-g38c-wxjf-xrh6

Sep 22, 2025

Moderate severity

### [@conventional-changelog/git-client has Argument Injection vulnerability ↗](https://github.com/advisories/GHSA-vh25-5764-9wcr)

@conventional-changelog/git-client · npm

CVE-2025-59433 · GHSA-vh25-5764-9wcr

Sep 16, 2025

High severity

### [@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode ↗](https://github.com/advisories/GHSA-65hm-pwj5-73pw)

@executeautomation/database-server · npm

CVE-2025-59333 · GHSA-65hm-pwj5-73pw

Sep 10, 2025

Critical severity

### [interactive-git-checkout has a Command Injection vulnerability ↗](https://github.com/advisories/GHSA-4wcm-7hjf-6xw5)

interactive-git-checkout · npm

CVE-2025-59046 · GHSA-4wcm-7hjf-6xw5

Sep 8, 2025

Critical severity

### [@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through exec API ↗](https://github.com/advisories/GHSA-3ch2-jxxc-v4xf)

@akoskm/create-mcp-server-stdio · npm

CVE-2025-54994 · GHSA-3ch2-jxxc-v4xf

Jul 28, 2025

High severity

Withdrawn

### [Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability ↗](https://github.com/advisories/GHSA-c2fv-2fmj-9xrx)

ssrfcheck · npm

GHSA-c2fv-2fmj-9xrx

Jul 23, 2025

High severity

Withdrawn

### [Withdrawn Advisory: bun vulnerable to OS Command Injection ↗](https://github.com/advisories/GHSA-4j66-8f4r-3pjx)

bun · npm

CVE-2025-8022 · GHSA-4j66-8f4r-3pjx

Jul 23, 2025

High severity

### [files-bucket-server vulnerable to Directory Traversal ↗](https://github.com/advisories/GHSA-3r3j-4vrw-884j)

files-bucket-server · npm

CVE-2025-8021 · GHSA-3r3j-4vrw-884j

Jul 23, 2025

High severity

### [private-ip vulnerable to Server-Side Request Forgery ↗](https://github.com/advisories/GHSA-9h3q-32c7-r533)

private-ip · npm

CVE-2025-8020 · GHSA-9h3q-32c7-r533

Jul 15, 2025

High severity

### [GitHub Kanban MCP Server vulnerable to Command Injection ↗](https://github.com/advisories/GHSA-6jx8-rcjx-vmwf)

@sunwood-ai-labs/github-kanban-mcp-server · npm

CVE-2025-53818 · GHSA-6jx8-rcjx-vmwf

Jun 26, 2025

Moderate severity

### [iOS Simulator MCP Command Injection allowed via exec API ↗](https://github.com/advisories/GHSA-6f6r-m9pv-67jw)

ios-simulator-mcp · npm

CVE-2025-52573 · GHSA-6f6r-m9pv-67jw

Mar 23, 2025

High severity

### [nossrf Server-Side Request Forgery (SSRF) ↗](https://github.com/advisories/GHSA-vm77-mr48-27wj)

nossrf · npm

CVE-2025-2691 · GHSA-vm77-mr48-27wj

Feb 12, 2025

High severity

### [parse-duration has a Regex Denial of Service that results in event loop delay and out of memory ↗](https://github.com/advisories/GHSA-hcrg-fc28-fcg5)

parse-duration · npm

CVE-2025-25283 · GHSA-hcrg-fc28-fcg5

Feb 6, 2025

Critical severity

### [Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc ↗](https://github.com/advisories/GHSA-j82m-pc2v-2484)

@nuxtjs/mdc · npm

CVE-2025-24981 · GHSA-j82m-pc2v-2484

Dec 18, 2024

Moderate severity

### [Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo ↗](https://github.com/advisories/GHSA-v9mx-4pqq-h232)

bun · npm

CVE-2024-21548 · GHSA-v9mx-4pqq-h232

Oct 8, 2024

Moderate severity

### [ggit is vulnerable to Arbitrary Argument Injection via the clone() API ↗](https://github.com/advisories/GHSA-pr45-cg4x-ff4m)

ggit · npm

CVE-2024-21533 · GHSA-pr45-cg4x-ff4m

Jun 10, 2024

High severity

### [ghtml Cross-Site Scripting (XSS) vulnerability ↗](https://github.com/advisories/GHSA-vvhj-v88f-5gxr)

ghtml · npm

CVE-2024-37166 · GHSA-vvhj-v88f-5gxr

Oct 3, 2023

High severity

### [static-server Path Traversal vulnerability ↗](https://github.com/advisories/GHSA-v834-rhv4-65m3)

static-server · npm

CVE-2023-26152 · GHSA-v834-rhv4-65m3

Sep 19, 2023

Moderate severity

### [blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API ↗](https://github.com/advisories/GHSA-6f9p-g466-f8v8)

blamer · npm

CVE-2023-26143 · GHSA-6f9p-g466-f8v8

May 10, 2023

High severity

### [m.static Directory Traversal vulnerability ↗](https://github.com/advisories/GHSA-vcxh-qvgr-9fw9)

m.static · npm

CVE-2023-26126 · GHSA-vcxh-qvgr-9fw9

Mar 6, 2023

High severity

### [node-static and @nubosoftware/node-static vulnerable to Directory Traversal ↗](https://github.com/advisories/GHSA-5g97-whc9-8g7j)

@nubosoftware/node-static · npm

CVE-2023-26111 · GHSA-5g97-whc9-8g7j

Feb 25, 2023

High severity

### [Denial of Service vulnerability in lite-web-server ↗](https://github.com/advisories/GHSA-8237-3q5g-99fv)

lite-web-server · npm

CVE-2023-26104 · GHSA-8237-3q5g-99fv

Feb 13, 2023

Moderate severity

### [Path traversal vulnerability in glance ↗](https://github.com/advisories/GHSA-3hjh-5hgx-f5wh)

glance · npm

CVE-2022-25937 · GHSA-3hjh-5hgx-f5wh

Jan 30, 2023

High severity

### [Servst vulnerable to Path Traversal ↗](https://github.com/advisories/GHSA-88v8-v46g-6c9w)

servst · npm

CVE-2022-25936 · GHSA-88v8-v46g-6c9w

Jan 26, 2023

High severity

### [Directory Traversal vulnerability in serve-lite ↗](https://github.com/advisories/GHSA-5qq4-m6c3-xxmf)

serve-lite · npm

CVE-2022-21192 · GHSA-5qq4-m6c3-xxmf

Jan 26, 2023

Moderate severity

### [Cross-site Scripting (XSS) in serve-lite ↗](https://github.com/advisories/GHSA-j8x7-qcw4-xx85)

serve-lite · npm

CVE-2022-25847 · GHSA-j8x7-qcw4-xx85

Dec 21, 2022

High severity

### [lite-dev-server vulnerable to Directory Traversal ↗](https://github.com/advisories/GHSA-pppv-ch8p-rp2w)

lite-dev-server · npm

CVE-2022-25895 · GHSA-pppv-ch8p-rp2w

Dec 20, 2022

High severity

### [easy-static-server vulnerable to Directory Traversal ↗](https://github.com/advisories/GHSA-wcwm-c3mr-pxcr)

easy-static-server · npm

CVE-2022-25931 · GHSA-wcwm-c3mr-pxcr

Dec 20, 2022

High severity

### [lite-server vulnerable to Denial of Service ↗](https://github.com/advisories/GHSA-89w7-5q45-r53w)

lite-server · Maven

CVE-2022-25940 · GHSA-89w7-5q45-r53w

Nov 29, 2022

High severity

### [static-dev-server vulnerable to path traversal ↗](https://github.com/advisories/GHSA-7fxm-c848-89q8)

static-dev-server · npm

CVE-2022-25848 · GHSA-7fxm-c848-89q8

Jul 2, 2022

High severity

### [Command injection in git-clone ↗](https://github.com/advisories/GHSA-8jmw-wjr8-2x66)

git-clone · npm

CVE-2022-25900 · GHSA-8jmw-wjr8-2x66

Jun 11, 2022

High severity

### [OS Command Injection in git-promise ↗](https://github.com/advisories/GHSA-chj3-f7xw-367m)

git-promise · npm

CVE-2022-24376 · GHSA-chj3-f7xw-367m

May 3, 2022

Critical severity

### [OS Command Injection in git-pull-or-clone ↗](https://github.com/advisories/GHSA-3x62-x456-q2vm)

git-pull-or-clone · npm

CVE-2022-24437 · GHSA-3x62-x456-q2vm

Apr 23, 2022

Critical severity

### [Command injection in git-interface ↗](https://github.com/advisories/GHSA-qffw-8wg7-h665)

git-interface · npm

CVE-2022-1440 · GHSA-qffw-8wg7-h665

Apr 2, 2022

High severity

### [Command injection in simple-git ↗](https://github.com/advisories/GHSA-28xr-mwxg-3qc8)

simple-git · npm

CVE-2022-24066 · GHSA-28xr-mwxg-3qc8

Sep 3, 2020

High severity

### [pullit vulnerable to command injection ↗](https://github.com/advisories/GHSA-8px5-63x9-5c7p)

pullit · npm

CVE-2018-25083 · GHSA-8px5-63x9-5c7p

No disclosures match these filters. Try another package or CVE, or reset the filters.