Web Programming
Español

Patch nowPHP & Laravel

Laravel AI SDK and Laravel MCP 1.0.1 fix an SSRF and an open redirect

Issue #2

Laravel AI SDK 1.0.1 fixes a moderate SSRF, and Laravel MCP 1.0.1 and 0.9.6 fix a low-severity open redirect in the OAuth flow.

Karlen TriminoSenior Full-Stack Engineer

Leer en español
Photo: Towfiqu barbhuiya / Pexels

What to do

Update laravel/ai and laravel/mcp to 1.0.1.

Key facts

Severity
Moderate
Affected
laravel/ai 1.0.0
Fixed in
laravel/ai 1.0.1, laravel/mcp 1.0.1, laravel/mcp 0.9.6
Advisory IDs
GHSA-6qhr-3g93-pxhw, GHSA-mx2h-h55v-pm44

Laravel AI SDK 1.0.1 (September 29) fixes a moderate SSRF (GHSA-6qhr-3g93-pxhw): the Vercel AI SDK and AG-UI adapters fetched client-supplied file URLs without validating them. Only 1.0.0 is affected.

Laravel MCP 1.0.1 and 0.9.6 (September 24) fix a low-severity open redirect in the OAuth flow (GHSA-mx2h-h55v-pm44). There are no new laravel/framework advisories this week.

Sources