AIKIDO-2026-10646
mcp-memory-service is vulnerable to Cross-site Scripting (XSS)
50
Medium Risk
This Affects:
mcp-memory-serviceTL;DR
Affected versions of this package render the OAuth redirect URL into HTML and JavaScript without escaping or scheme filtering. A registered redirect URI containing crafted HTML or a script-capable scheme can break out of the response and run code in the user's browser.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
mcp-memory-service is vulnerable to Cross-site Scripting (XSS) in versions 8.24.0 - 10.39.1.
How to fix this
Upgrade the mcp-memory-service library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.