What is GHSA-RP72-5V5Q-2446?

GHSA-RP72-5V5Q-2446 is a low-severity path traversal vulnerability in @cardano402/mcp-server (npm), affecting versions <= 0.1.1. It is fixed in 0.1.2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.

Which versions of @cardano402/mcp-server are affected by GHSA-RP72-5V5Q-2446?

@cardano402/mcp-server (npm) versions <= 0.1.1 is affected.

Is there a fix for GHSA-RP72-5V5Q-2446?

Yes. GHSA-RP72-5V5Q-2446 is fixed in 0.1.2. Upgrade to this version or later.

Is GHSA-RP72-5V5Q-2446 exploitable, and should I be worried?

Whether GHSA-RP72-5V5Q-2446 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether GHSA-RP72-5V5Q-2446 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix GHSA-RP72-5V5Q-2446?

Upgrade @cardano402/mcp-server to 0.1.2 or later.

GHSA-RP72-5V5Q-2446 in @cardano402/mcp-server

Q: Which versions of @cardano402/mcp-server are affected by GHSA-RP72-5V5Q-2446?

@cardano402/mcp-server (npm) versions <= 0.1.1 is affected.

Q: Is there a fix for GHSA-RP72-5V5Q-2446?

Yes. GHSA-RP72-5V5Q-2446 is fixed in 0.1.2. Upgrade to this version or later.

Q: Is GHSA-RP72-5V5Q-2446 exploitable, and should I be worried?

Whether GHSA-RP72-5V5Q-2446 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether GHSA-RP72-5V5Q-2446 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix GHSA-RP72-5V5Q-2446?

Upgrade @cardano402/mcp-server to 0.1.2 or later.

Summary

@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url

@cardano402/mcp-server versions <= 0.1.1 ship three security gaps that can lead to unauthorized fund movement when the package is used as designed (an MCP server exposing Cardano payment tools to an

1. No spending limits on signed payments

An LLM (or prompt-injected LLM) calling tools registered by the MCP server can invoke them in a loop. Each call signs a real Cardano transaction for the catalog-advertised amount. There is no per-call cap, daily ceiling, MCP elicitation/confirmation step, or recipient allowlist. The MAINNET=true env-var guardrail can be bypassed by any LLM with shell-tool access. Worst case: full wallet drain.

2. HTTP transport binds 0.0.0.0 without authentication

cardano402-mcp --transport http listens on all interfaces with no Origin allowlist, no bearer-token requirement, and no CORS check. Anyone on the same LAN can POST MCP tools/call and trigger signed payments from the operator's wallet.

3. SSRF via `catalog.server.url`

A malicious catalog can declare a server.url pointing at internal infrastructure (e.g. http://169.254.169.254/latest/meta-data). The allowInsecure guard in 0.1.1 only checks the catalog URL itself, not the server.url it returns. endpoint.path is also not normalized, so .. traversal or absolute URLs work.

Impact

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

Affected versions

@cardano402/mcp-server (<= 0.1.1)

Security releases

@cardano402/mcp-server → 0.1.2 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Fixed in @cardano402/[email protected]:

Per-call and per-day spending limits (default 5 ADA / 50 ADA) + optional recipient allowlist + MCP elicitation/create confirmation hook.
HTTP transport defaults to 127.0.0.1; non-loopback requires --http-bearer-token; per-request Origin allowlist + bearer check.
catalog.server.url validated against private-CIDR rules (RFC1918, RFC4193, link-local, CGNAT, multicast, IPv4-mapped IPv6, loopback) unless CARDANO402_ALLOW_INSECURE=true.
endpoint.path rejected if it contains .., NUL, whitespace/CRLF, an absolute URL, or //host/....
Per-tool mainnet opt-in via --mainnet-confirmed-tools.

Workarounds for 0.1.1 users

Do not run with --transport http on an untrusted network; use --transport stdio (default).
Only point the server at catalogs you control or have audited.
Use a low-balance hot wallet, never your main wallet.
Avoid MAINNET=true until upgraded to 0.1.2.

Frequently Asked Questions

What is GHSA-RP72-5V5Q-2446? GHSA-RP72-5V5Q-2446 is a low-severity path traversal vulnerability in @cardano402/mcp-server (npm), affecting versions <= 0.1.1. It is fixed in 0.1.2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
Which versions of @cardano402/mcp-server are affected by GHSA-RP72-5V5Q-2446? @cardano402/mcp-server (npm) versions <= 0.1.1 is affected.
Is there a fix for GHSA-RP72-5V5Q-2446? Yes. GHSA-RP72-5V5Q-2446 is fixed in 0.1.2. Upgrade to this version or later.
Is GHSA-RP72-5V5Q-2446 exploitable, and should I be worried? Whether GHSA-RP72-5V5Q-2446 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether GHSA-RP72-5V5Q-2446 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix GHSA-RP72-5V5Q-2446? Upgrade @cardano402/mcp-server to 0.1.2 or later.