Apify Mcp Server
Approved changes feed: RSS · Atom
cpe:2.3:a:apify:apify-mcp-server:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apify (0e68a139-1413-53c7-b7a4-fb29f1bb7a12) |
|---|---|
| Product | Apify Mcp Server (7864f6ca-9da3-52a0-8b58-7c77c8ed87c9) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:npm/@apify/actors-mcp-server |
purl2cpe | 2026-09-09 08:34:19.204734 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-46341 |
vulnerable | 2026-07-29 00:54:58.834816 |
Apify MCP server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
MEDIUM (6.1)
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates allowlisted documentation domains with String.startsWith() rather than URL hostname comparison, allowing attacker-controlled URLs such as `https://docs.apify.com.evil.com/` and `https://docs.apify.com@evil.com/` to pass the ALLOWED_DOC_DOMAINS check and return arbitrary fetched content to the LLM. This issue is fixed in version 0.9.21.
Published: 2026-07-16T16:54:01.843Z
Updated: 2026-07-17T14:01:46.108Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.