VDB
GCVE-110-OSM-2026-8174
GCVE-110-OSM-2026-8174
Advisory PublishedCVSS 5.4/10
Suspicious package detected. Behaviors: network activity.
ENTRY
setup.py (install-hook: install/develop/build override present)
EXFIL
- Suspicious Domain in PKG-INFO: "https://modelcontextprotocol.io"
- Suspicious Domain in src/data_proxy_for_test.egg-info/PKG-INFO: "https://modelcontextprotocol.io"
INDICATORS (IOCs)
- urls: http://example.io/sse, https://server.local/sse, https://modelcontextprotocol.io/docs/tools/inspector, https://server.local/sse\n, http://{mcp_settings.bind_host (+2 more)
- domains: modelcontextprotocol.io, data-proxy-for-test.oss-cn-hangzhou.aliyuncs.com
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | data-proxy-for-test | all (affected) | — |
Aliases
Browse GCVE Records
75,874 records in the GCVE database · Updated August 4, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.