CVE-2026-53957

### Summary `export_space` and `import_space` tools in `@contentful/mcp-tools` accept LLM-controlled `host` and `proxy` parameters that are spread directly into the options object passed to `contentful-export` / `contentful-import`. These libraries pass the merged options — including the attacker-controlled `host` — to the Contentful Management API (CMA) SDK, which builds `baseURL` from `host` and attaches the server's CMA Personal Access Token as `Authorization: Bearer <PAT>` on every outgoing request. An attacker who can invoke MCP tools, or inject instructions into Contentful content the LLM reads, can redirect all CMA requests — and the PAT — to an attacker-controlled endpoint. --- ### Details **Root cause — `exportSpace.ts` lines 126–141** (identical pattern in `importSpace.ts` lines 103–119): ```typescript // packages/mcp-tools/src/tools/jobs/space-to-space-migration/exportSpace.ts const clientConfig = createClientConfig(config); // only extracts accessToken; discards config.host const managementToken = clientConfig.accessToken; // server's CMA PAT const exportOptions = { ...args, // ← LLM-controlled tool call args: args.host enters here, unfiltered managementToken, // ← server PAT injected alongside attacker-controlled host environmentId: args.environmentId || 'master', exportDir: args.exportDir || process.cwd(), contentFile: args.contentFile || `contentful-export-${args.spaceId}.json`, }; const contentfulExport = await import('contentful-export'); await contentfulExport.default(exportOptions); // host + PAT reach the SDK here ``` `createClientConfig` (defined in `utils/tools.ts`) extracts only `accessToken` and ignores `config.host`. The `CONTENTFUL_HOST` environment variable is never applied to `exportOptions`. The downstream chain once `contentful-export` receives the merged options: 1. `parseOptions.js` line 61: `options.accessToken = options.managementToken` — PAT flows to `accessToken` 2. `init-client.j