SearXNG Search
MCP server for SearXNG — privacy-respecting web search with pagination, URL reading
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.ihor-sokoliuk/mcp-searxng
· Source code · Our trust grade: B
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| GHSA-hjwh-xvfw-qrwjSearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses | medium | Not flagged | Aug 19, 2026 |
| GHSA-wppf-h75h-6pm6SearXNG MCP Server: Additional hardened-mode SSRF bypassesAlso filed as CVE-2026-54689 | medium | Not flagged | Aug 19, 2026 |
| GHSA-q87f-qc2r-2gw4SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)Also filed as CVE-2026-54688 | medium | Not flagged | Aug 19, 2026 |
| GHSA-mrvx-jmjw-vggcSearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`Also filed as CVE-2026-58485 | high | Not flagged | Jun 19, 2026 |
| GHSA-xcqx-9jf5-w339SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`Also filed as CVE-2026-58483 | high | Not flagged | Jun 19, 2026 |
Versions in the registry
2.10.0 (listed), 2.9.0, 2.8.1, 2.8.0, 2.7.0, 2.6.0, 2.5.1, 2.5.0, 2.4.0, 2.3.0, 2.2.0, 2.1.0, 2.0.0, 1.16.0, 1.15.0, 1.14.1, 1.14.0, 1.13.0, 1.12.1, 1.12.0, 1.11.1, 1.11.0, 1.10.1, 1.10.0, 1.9.0, 1.8.0, 1.7.2, 1.7.1, 1.7.0, 1.6.0 and 19 older