CVE-2026-5607 | imprvhub mcp-browser-agent up to 0.8.0 URL Parameter src/handlers.ts CallToolRequestSchema request.params.name/request.params.arguments server-side request forgery

A vulnerability was found in imprvhub mcp-browser-agent up to 0.8.0. It has been rated as critical. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-5607. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.