Is mpp safe ? mpp (hex) has 13 known vulnerabilities, the worst rated HIGH. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so hex packages are not covered.
cvss CVSS v4.0 base score out of 10
epss chance of exploitation in 30 days, 45th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-5qrp-r24c-w6jr, the advisory selected below
// 13 advisories GHSA-5qrp-r24c-w6jr Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored… HIGH GHSA-rpwj-vrf7-4x36 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored… HIGH GHSA-j4j7-7xpr-c7cr Allocation of Resources Without Limits or Throttling in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet through concurrent… HIGH GHSA-vp5h-xh25-44wf Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain… HIGH GHSA-34g7-vx6g-82mq Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated third party to obtain paid resources by replaying a transfer settled by an… HIGH GHSA-vv77-66rf-pm86 Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet in a single request by… HIGH GHSA-vj8p-hp9x-gh47 When the server acts as the fee payer, mpp Elixir 0.4.0 (ZenHive/mpp) does not validate whether the gaslimit set by the client is enough before broadcasting. HIGH GHSA-82qh-vrvm-gqvc Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients that never paid. MEDI GHSA-8x7x-5j8g-8hcx Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submission gate twice… MEDI GHSA-w8j7-7qc3-5f24 Time-of-check Time-of-use (TOCTOU) Race Condition in ZenHive mpp allows an unauthenticated remote client to redeem one confirmed on-chain payment for multiple… MEDI Show all 13 advisories Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored…
Full advisory text at GitHub advisory , NVD or OSV .
// cvss v4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Attack vector Network
Attack complexity Low
Attack requirements Present
Privileges required None
User interaction None
Confidentiality (vulnerable system) None
Integrity (vulnerable system) High
Availability (vulnerable system) Low
Confidentiality (subsequent systems) None
Integrity (subsequent systems) None
Availability (subsequent systems) None // questions Is mpp safe to install? CyberXYZ does not call a package safe in absolute terms. It records 13 known vulnerabilities for mpp (hex), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does mpp have known vulnerabilities? Yes. CyberXYZ records 13 known vulnerabilities for mpp (hex), the worst rated HIGH. These include GHSA-5qrp-r24c-w6jr, GHSA-rpwj-vrf7-4x36, GHSA-j4j7-7xpr-c7cr, GHSA-vp5h-xh25-44wf, GHSA-34g7-vx6g-82mq.
How do I check mpp before installing? Search mpp in CyberXYZ Check at https://cyberxyz.io/check?q=mpp . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 07:00 UTC. The most recent advisory here was published 2026-09-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page