Product
The @sylphx/pdf-reader-mcp package contains an authentication bypass vulnerability in its HTTP transport implementation that exposes local files and PDF tools to unauthorized network requests.