{"id":"CVE-2026-19984","summary":"jkawamoto mcp-florence2 __init__.py get_images server-side request forgery","details":"A flaw has been found in jkawamoto mcp-florence2 up to 0.3.13. Affected by this issue is the function get_images of the file src/mcp_florence2/__init__.py. This manipulation of the argument src causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. It is recommended to change the configuration settings. The vendor explains: \"For deployments where SSRF protection is required, I recommend routing all HTTP(S) requests through an SSRF-safe proxy server. This approach mitigates the vulnerability without requiring changes to the mcp-florence2 source code.\"","modified":"2026-08-22T03:31:10.415659927Z","published":"2026-08-17T04:45:09.899Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19984.json"},"references":[{"type":"WEB","url":"https://github.com/jkawamoto/mcp-florence2/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19984.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19984"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-19984"},{"type":"ADVISORY","url":"https://vuldb.com/submit/873920"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/391184"},{"type":"REPORT","url":"https://github.com/jkawamoto/mcp-florence2/issues/59"},{"type":"REPORT","url":"https://vuldb.com/vuln/391184/cti"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jkawamoto/mcp-florence2","events":[{"introduced":"77b0bfb8668b0795b9c0e8118fc4e6e3ea61f3e0"},{"last_affected":"e8dd4e908e89588eb838aa036d8b564d0e39b8c6"}],"database_specific":{"extracted_events":[{"introduced":"0.3.0"},{"last_affected":"0.3.0"},{"introduced":"0.3.1"},{"last_affected":"0.3.1"},{"introduced":"0.3.2"},{"last_affected":"0.3.2"},{"introduced":"0.3.3"},{"last_affected":"0.3.3"},{"introduced":"0.3.4"},{"last_affected":"0.3.4"},{"introduced":"0.3.5"},{"last_affected":"0.3.5"},{"introduced":"0.3.6"},{"last_affected":"0.3.6"},{"introduced":"0.3.7"},{"last_affected":"0.3.7"},{"introduced":"0.3.8"},{"last_affected":"0.3.8"},{"introduced":"0.3.9"},{"last_affected":"0.3.9"},{"introduced":"0.3.10"},{"last_affected":"0.3.10"},{"introduced":"0.3.11"},{"last_affected":"0.3.11"},{"introduced":"0.3.12"},{"last_affected":"0.3.12"},{"introduced":"0.3.13"},{"last_affected":"0.3.13"}],"source":"AFFECTED_FIELD"}}],"versions":["0.3.0","0.3.1","0.3.10","0.3.11","0.3.12","0.3.13","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","v0.3.13","v0.3.12","v0.3.11","v0.3.10","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19984.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}