N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59155

CVE-2025-59155: HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability

Impact

A Server-Side Request Forgery (SSRF) vulnerability that affects all users running the HackMD MCP server in HTTP mode. Attackers could exploit this vulnerability by passing arbitrary hackmdApiUrl values through HTTP headers (Hackmd-Api-Url) or base64-encoded JSON query parameters. This allows malicious users to:

Redirect API calls to internal network services
Potentially access sensitive internal endpoints
Perform network reconnaissance through the server
Bypass network access controls

The vulnerability affects the HTTP transport mode specifically - stdio mode is not impacted as it only accepts requests from stdio.

Patches

The vulnerability has been patched in version 1.5.0. Users should:

Update to the latest version of the HackMD MCP server
Set the ALLOWED_HACKMD_API_URLS environment variable to restrict allowed HackMD API endpoints
If not set, the server will default to only allowing the official HackMD API URL (https://api.hackmd.io/v1)

Example configuration:

ALLOWED_HACKMD_API_URLS=https://api.hackmd.io/v1,https://your-hackmd-instance.com/api/v1

Workarounds

Users can mitigate this vulnerability without upgrading by:

Use stdio mode instead of HTTP mode: Set TRANSPORT=stdio or remove the TRANSPORT environment variable to disable HTTP mode entirely
Network-level restrictions: Use firewall rules or network policies to restrict outbound connections from the server
Reverse proxy filtering: Place the MCP server behind a reverse proxy that validates and filters both the Hackmd-Api-Url header and the base64-encoded JSON config query parameter to prevent malicious hackmdApiUrl values

References

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59155

CVE-2025-59155:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
hackmd-mcp	npm	>= 1.4.0, < 1.5.0	1.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a Server-Side Request Forgery (SSRF) in the HackMD MCP server, identified as GHSA-g5cg-6c7v-mmpw. The root cause is the lack of validation for the hackmdApiUrl parameter, which can be controlled by an attacker through HTTP headers or query parameters.

My analysis of the patch commit 43936c78a5bb3dedc74e8f080607a1125caa8c13 reveals the exact location of the vulnerability and the subsequent fix. The vulnerable code path originates in the main request handler for the HTTP transport, specifically the anonymous function handling app.post("/mcp", ...) in index.ts.

In the vulnerable version, this handler would call the parseConfig function to extract the hackmdApiUrl from the request. This URL was then used to initialize the MCP server's API client without being checked against an allowlist. This allowed an attacker to force the server to make requests to arbitrary internal or external services.

The patch addresses this by introducing an allowlist mechanism. A new environment variable, ALLOWED_HACKMD_API_URLS, is used to define a set of trusted base URLs. The app.post("/mcp") handler was modified to include a validation step using a new function, isAllowedApiUrl, which checks the provided hackmdApiUrl against this list. If the URL is not permitted, the request is rejected with a 400 status code, effectively mitigating the SSRF risk.

Therefore, the key functions that would appear in a runtime profile during exploitation are the app.post("/mcp") handler, which is the entry point for the malicious request, and the parseConfig function, which extracts the malicious payload.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.