The mcp-sanitizer URL sanitizer has an SSRF bypass vulnerability; explicit ports or bracketed IPv6 can reach loopback addresses

A GitHub security advisory disclosed that versions of the npm package mcp-sanitizer before 1.4.0 have an SSRF bypass vulnerability, fixed in 1.4.0. The library is used to validate URL parameters before MCP tools such as web_fetch and web_scraper make outbound requests; the flaw is in the validateURLLocation() function on the default code path: a localhost address with an explicit port (such as http://localhost:8080/）就不会被拦截；Node.js the IPv6 hostnames returned by the URL API carry their own brackets (such as [::1], [fe80::1]), which never match a comparison against strings without brackets, so loopback and link-local addresses are missed. An attacker who can control the url parameter can make the server access internal services and read responses, including the cloud metadata endpoint http://169.254.169.254/ and admin panels, potentially leaking credentials, tokens, or sensitive configuration.