CVE-2026-49856: vmoranv @jshookmcp/jshook SSRF in ICMP and traceroute handlers

Executive brief

A vulnerability in the jshookmcp network tool allows users to bypass security restrictions and probe internal network addresses. While the software is designed to block access to private local networks, certain diagnostic tools like ICMP ping and traceroute fail to check these rules. An attacker could use this to map out a company's internal network infrastructure and identify active servers from the perspective of the jshookmcp server.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in @jshookmcp/jshook version 0.3.1. While the 'network_rtt_measure' and 'network_latency_stats' handlers correctly invoke 'resolveAuthorizedTransportTarget' to enforce a central SSRF policy, the 'network_traceroute' and 'network_icmp_probe' handlers bypass this check. These vulnerable handlers use 'resolveHostname' which performs DNS lookups or returns IP literals without validating if the target belongs to private, loopback, or reserved address ranges. An authenticated MCP client can exploit this to perform internal reachability tests and route mapping. The issue is fixed in version 0.3.2.

Affected products

• vmoranv @jshookmcp/jshook 0.3.1

Timeline

• 2026-05-27: disclosed: Vulnerability reported in vmoranv/jshookmcp
• 2026-07-01: advisory: GitHub Advisory published
• 2026-07-01: patched: Version 0.3.2 released

References

• https://api.github.com/users/DavidCarliez
• https://github.com/DavidCarliez
• https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D
• https://api.github.com/users/DavidCarliez/repos
• https://avatars.githubusercontent.com/u/271374756?v=4
• https://api.github.com/users/DavidCarliez/events%7B/privacy%7D