zotero-mcp CVE-2026-108583

Requires zotero-mcp version 0.10.0 through 0.14.1 deployed as an MCP server wired to an LLM agent, with the zotero_add_by_url tool exposed. The attacker must first achieve a successful prompt injection that steers the agent into calling zotero_add_by_url with an attacker-controlled URL; the server's _fetch_embedded_metadata then fetches that URL (and follows redirects) with no destination validation, allowing reach to loopback, private (RFC1918), or link-local (e.g., 169.254.169.254) hosts. Limiting factors: exploitation depends on the chained prompt-injection succeeding (AT:P) and on agent/user interaction (UI:P), not direct network reach; impact is confined to leaking citation meta-tags and error details (Low confidentiality/integrity, no availability impact), and an internal service must actually be reachable from the server's network position.

This is a genuinely low-priority issue despite being a real, confirmed vulnerability. The vendor CVSS 4.0 base score is only 2.3, and the vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N, no subsequent-system impact) describes a server-side request forgery whose exploitation is gated on an attack requirement (AT:P) and passive user/agent interaction (UI:P), with only Low confidentiality and Low integrity impact. No EPSS score was provided in the input and there is no CISA KEV listing, so exploitation probability signals are absent rather than contradictory. There is no explicit POC=YES flag; a third-party technical write-up (hackmd) and the VulnCheck advisory document the mechanism but no weaponized exploit code is indicated in the provided data. The dominant real-world constraint is that exploitation depends on an upstream prompt-injection succeeding against the LLM agent driving the MCP server - a non-trivial precondition - and the payoff is limited to leaking citation meta-tags and error details from internal services, not RCE or bulk data theft. Net: a real defect worth patching, but not an emergency; its risk is bounded by low impact and a chained precondition rather than by any single missing data point.

An attacker plants a prompt-injection payload (e.g., in a document, webpage, or citation record the AI agent later processes) that steers the agent into invoking the zotero_add_by_url tool against an attacker-chosen internal URL such as http://169.254.169.254/ or a loopback admin service. Because _fetch_embedded_metadata fetches the URL without destination validation and follows redirects, the MCP server reaches the internal host and returns citation meta-tags and error details to the attacker, confirming reachability and leaking limited internal information. No public exploit code is identified in the provided data, though a technical write-up describing the flaw exists.