GitHub Advisoryadvisory · PyPI

GHSA-vcqx-v2mg-7chx Neo4j Cypher MCP server is vulnerable to DNS rebinding

HIGH Published 2025-09-11 Modified 2025-09-11 Official page ↗
Aliases
CVE-2025-10193
Ecosystem
PyPI
Packages
mcp-neo4j-cypher
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-346
Reviewed
2025-09-11

Affected packages

• PyPI mcp-neo4j-cypher: >= 0.2.2, < 0.4.0 → fixed in 0.4.0

Description

Impact DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute unauthorised tool invocations against locally running Neo4j MCP instances.&nbsp;The attack relies on the user being enticed to visit a malicious website and spend sufficient time there for DNS rebinding to succeed. Patches CORS Middleware added to Cypher MCP server v0.4.0 that blocks all web-based access by default. Workarounds If you cannot upgrade to v0.4.0 and above, use stdio mode. References Vendor Advisory https://www.cve.org/CVERecord?id=CVE-2025-10193 Credits We want to publicly recognize the contribution of Evan Harris from mcpsec.dev for reporting this issue and following the responsible disclosure policy.

Related

Alias · CVE (1)

  • CVE-2025-10193 DNS rebinding vulnerability in Neo4j Cypher MCP server allows malicious websites to bypass Same-Origin Policy protections and execute… vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References