CVE-2026-53711: mcp-context-forge >= 0.2.0, < 0.3.1

Affected technology

mcp-context-forge · >= 0.2.0, < 0.3.1
IBM

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · Passive user interaction

What an attacker can do

An authenticated attacker can save markup containing script-capable event handlers, and the code executes when another user views the saved prompt. Vendor/CNA’s CVSS 4.0 assessment (base score 5.1/10) rates confidentiality, integrity and availability impact as none.