tidewave
MCP server with runtime-level tools for Phoenix development
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 35
- Cadence
- ~7 days
- Last 12 months
- 16
Reach
- Downloads
- 2.5M
- Stars
- 858
Details
- License
- Apache-2.0
- First release
- Apr 29, 2025
| Version | Released | |
|---|---|---|
0.9.2
patch
| ||
0.9.1
patch
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.9.0
minor
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.8.4
patch
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.8.3
patch
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.8.2
patch
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.8.1
patch
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.8.0
minor
1 CVE
CVE-2026-109823
EEF-CVE-2026-109823
Oct 27, 2026
Host filesystem path disclosure via DNS rebinding
Medium
Network
Low
None
SummaryAn attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the This issue affects tidewave: from 0.8.0 before 0.9.2. Details1. Data collection. 2. Exposure. 3. Read access. Proof of concept
ImpactA malicious web page that a developer visits while the Phoenix development server runs can learn the developer's username, project location, and dependency layout on disk. This information helps an attacker prepare further attacks against the machine. Affected versions
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.9.1
Fixed in
0.9.2
References Updated Oct 27, 2026 · Source: OSV.dev | ||
0.6.1
patch
| ||
0.6.0
minor
| ||
0.5.6
patch
| ||
0.5.5
patch
| ||
0.5.4
patch
| ||
0.5.3
patch
| ||
0.5.2
patch
| ||
0.5.1
patch
| ||
0.5.0
minor
| ||
0.4.2
patch
| ||
0.4.1
patch
| ||
0.4.0
minor
| ||
0.3.2
patch
| ||
0.3.1
patch
| ||
0.3.0
minor
| ||
0.2.0
minor
| ||
0.1.10
patch
| ||
0.1.9
patch
| ||
0.1.8
patch
| ||
0.1.7
patch
| ||
0.1.6
patch
| ||
0.1.5
patch
| ||
0.1.4
patch
| ||
0.1.3
patch
| ||
0.1.2
patch
| ||
0.1.1
patch
| ||
0.1.0
initial
|