GCVE-110-OSM-2026-172

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published May 22, 2026

[osmalyze-auto] Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. [osmalyze-auto] Entrypoint: src/interactsh_mcp/server.py (console-script: interactsh-mcp=interactsh_mcp.server:main) Exfil: http://payload_url/` (custom-c2, recovery: plaintext in PKG-INFO) Payload: src/interactsh_mcp/client.py Key findings: - OAST/Interactsh Exfiltration in PKG-INFO: ".oast.pro" - OAST/Interactsh Exfiltration in src/interactsh_mcp/client.py: "oast.site" - Data Encoding for Exfiltration in src/interactsh_mcp/client.py: "base64.b64encode(" - Rapid Version Publishing IOCs: - ipv4: 203.0.113.5 - urls: http://payload_url/`, https://projectdiscovery.io/, https://{server.host - domains: zeropath.com, c7lci09s8mts0o3og0g0abc12.oast.pro, projectdiscovery.io, oast.pro, oast.live (+4 more) - emails: raphael@zeropath.com - payloadFileHash: ce7416523214e56a2d64407d500627c7bdd7fc28f8512c710abbf70d71da7b37

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	spark-ml-utilities	all (affected), all (affected), all (affected), all (affected)	—
unknown	interactsh-mcp	0.1.1 (affected)	—
unknown	@emilgroup/account-sdk-node	all (affected)	—
unknown	requests-ml-min	all (affected), * (affected), all (affected), all (affected), all (affected), * (affected), * (affected)	—
unknown	identityapi	all (affected), all (affected), all (affected), all (affected)	—