THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5gm3-9crp-6g3v (medium) — Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

[GHSA] GHSA-5gm3-9crp-6g3v (medium) — Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

highgithub_advisoriesPublished 2026-09-18

GHSA-5gm3-9crp-6g3v Severity: medium CVE: CVE-2026-77339

Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools

## Summary

A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener when MCP SSE is enabled. The vulnerable path accepts browser-origin requests before any Host validation, Origin validation, or cal

Indicators of compromise

d56aa59df04b72f8644811ac581a051bec05e485sha1
CVE-2026-77339cve
http://attacker.example:8081`url
http://attacker.example:8081url

Original source: https://github.com/advisories/GHSA-5gm3-9crp-6g3v