engram

Security check static checks

27 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 24 Oct 2026 by edna-skill-static-v1 main@761a7da48495. What it checks

• Critical proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (affects proxy-addr 2.0.7, pinned in packages/mcp-server-node/package-lock.json).
• High MCP TypeScript SDK: Experimental tasks were not tied to the session that created them (affects @modelcontextprotocol/sdk 1.29.0, pinned in packages/mcp-server-node/package-lock.json).
• High MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation (affects @modelcontextprotocol/sdk 1.29.0, pinned in packages/mcp-server-node/package-lock.json).
• High MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server (affects @modelcontextprotocol/sdk 1.29.0, pinned in packages/mcp-server-node/package-lock.json).
• High body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body (affects body-parser 2.2.2, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to host confusion via failed IDN canonicalization (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to host confusion via backslash authority introducer (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded scheme normalization (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to path traversal via percent-encoded dot segments (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to authority injection via an unvalidated port in serialize (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to host confusion via literal backslash authority delimiter (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High fast-uri vulnerable to host confusion via percent-encoded authority delimiters (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• High ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• High Zod can exhaust memory while validating oversized constrained collections (affects zod 4.3.6, pinned in packages/mcp-server-node/package-lock.json).
• Medium Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (affects @hono/node-server 1.19.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies (affects @modelcontextprotocol/sdk 1.29.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service (affects @modelcontextprotocol/sdk 1.29.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Algorithmic Complexity DoS in Language Middleware (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: ReDoS in CORS middleware via Access-Control-Request-Headers (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: bodyLimit() can be bypassed for chunked / unknown-length requests (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: JWT middleware accepts any Authorization scheme, not only Bearer (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono/jsx does not isolate context per request, leading to cross-request data disclosure (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono/jsx renders plain strings unescaped in boundary components, leading to XSS (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono has CSS Declaration Injection via Style Object Values in JSX SSR (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Medium ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium ip-address has XSS in Address6 HTML-emitting methods (affects ip-address 10.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Medium qs: Denial of Service via Attacker Controlled isBuffer (affects qs 6.15.1, pinned in packages/mcp-server-node/package-lock.json).
• Medium qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set (affects qs 6.15.1, pinned in packages/mcp-server-node/package-lock.json).
• Medium qs array-limit bypass via bracket-key comma parsing (affects qs 6.15.1, pinned in packages/mcp-server-node/package-lock.json).
• Medium uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided (affects uuid 9.0.1, pinned in package-lock.json).
• Medium Sends data to a host outside the well-known APIs, host api.engrammemory.ai, fonts.gstatic.com: mcp/server.py, docker/mcp/dashboard.py, line 941, 2 places in all.
• Low body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement (affects body-parser 2.2.2, pinned in packages/mcp-server-node/package-lock.json).
• Low esbuild allows arbitrary file read when running the development server on Windows (affects esbuild 0.27.7, pinned in packages/mcp-server-node/package-lock.json).
• Low fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Low fast-uri vulnerable to improper path equivalence in relative reference normalization (affects fast-uri 3.1.0, pinned in packages/mcp-server-node/package-lock.json).
• Low Hono: Proxy Helper does not remove response headers listed in the `Connection` header (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Low Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() (affects hono 4.12.14, pinned in packages/mcp-server-node/package-lock.json).
• Low Sends data to a host outside the well-known APIs (to an address set at run time): scripts/fastembed_setup.py, scripts/memory_search.py, scripts/memory_store.py and 2 more files, line 122, 5 places in all.
• Note 90 files were not read (over 512 KB, or past the 60 file cap): src/recall/recall_engine.py, packages/mcp-server-node/src/graph.ts, packages/mcp-server-node/src/index.ts and more.
• Note 33 of 161 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.