EUVD-2026-54887
GHSA-jg2j-2qmx-58vq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack vector with low-privilege required; SSRF yields limited internal resource disclosure and potential write-side effects; no direct availability impact identified.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in adenot mcp-google-search up to 0.3.1. Impacted is an unknown function of the file src/index.ts of the component read_webpage. Executing a manipulation of the argument url can lead to server-side request forgery. The attack is restricted to local execution. This patch is called f071d491b685011ca04e8ab8d586fc65f86bcee1. It is advisable to implement a patch to correct this issue.
AnalysisAI
Server-Side Request Forgery in adenot mcp-google-search up to version 0.3.1 allows a local low-privileged user to direct the read_webpage tool to fetch arbitrary internal network resources, including localhost, RFC 1918 ranges, cloud metadata endpoints, and link-local addresses, by supplying a crafted url argument. The vulnerability stems from the absence of URL validation prior to Axios-driven HTTP fetching in src/index.ts. No active exploitation is confirmed and no CISA KEV listing exists, though the CVSS 4.0 E:P modifier indicates proof-of-concept code exists; an upstream fix is available via a specific commit.
Technical ContextAI
mcp-google-search is a Node.js MCP (Model Context Protocol) server that exposes Google search and webpage reading capabilities as tools callable by AI assistants such as Claude. The read_webpage tool in src/index.ts accepted any URL string and passed it directly to Axios without protocol restriction, hostname validation, or DNS-based private-IP filtering - a textbook CWE-918 (Server-Side Request Forgery) flaw. The commit fix adds an async validateUrl() function that enforces http/https-only protocols, resolves the hostname via dns.promises.lookup, and checks all returned addresses against private/reserved ranges (10.x, 172.16-31.x, 192.168.x, 127.x, 169.254.x, ::1, fe80::, fc00::/fd00::, and IPv4-mapped IPv6 addresses). Redirect following is also disabled (maxRedirects: 0) to prevent redirect-chain bypasses. No CPE identifier is provided in the source intelligence.
RemediationAI
Apply the upstream fix available in commit f071d491b685011ca04e8ab8d586fc65f86bcee1 at https://github.com/adenot/mcp-google-search/commit/f071d491b685011ca04e8ab8d586fc65f86bcee1, which introduces URL validation, private IP blocking, and redirect disabling. A tagged patched release version is not independently confirmed - verify that the installed package includes this commit or pull directly from the patched HEAD. Pull request 13 at https://github.com/adenot/mcp-google-search/pull/13 tracks the merge. As a compensating control prior to patching, restrict the MCP server process's outbound network access using OS-level firewall rules or container network policies to block connections to RFC 1918 ranges, localhost (127.0.0.0/8), and link-local (169.254.0.0/16); note this approach may interfere with legitimate internal network features if any exist.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today