EUVD-2026-54963
GHSA-wmf6-8cmx-6fp6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SSRF provides network-reachable read access to internal resources; PR:L reflects required low-privilege auth; no integrity or availability impact in baseline SSRF without chained exploitation.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetch_article of the file news_scraper_mcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in dmitriiweb article-scraper-mcp 1.0.0 allows low-privileged remote attackers to manipulate the url argument of the fetch_article function in news_scraper_mcp/server.py, causing the server to issue arbitrary HTTP requests to internal or external resources. Publicly available exploit code exists via GitHub issue #3, and the maintainer has not responded to responsible disclosure, meaning no patch is currently available. Risk is most significant in cloud-hosted deployments where the server can reach instance metadata services or internal network segments.
Technical ContextAI
article-scraper-mcp is a Python-based Model Context Protocol (MCP) server (CPE: cpe:2.3:a:dmitriiweb:article-scraper-mcp:*:*:*:*:*:*:*:*) designed to fetch and parse news articles from caller-supplied URLs. The fetch_article function in news_scraper_mcp/server.py passes the url parameter directly to an HTTP client without validating or allowlisting the destination. CWE-918 (Server-Side Request Forgery) describes this root cause: the application acts as an uncontrolled HTTP proxy, issuing requests on behalf of the attacker to destinations the attacker cannot reach directly. This is particularly dangerous in cloud environments where unauthenticated IMDSv1 metadata endpoints (e.g., 169.254.169.254) are reachable from the server's network namespace, potentially exposing IAM credentials or other sensitive metadata.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer has not responded to the responsible disclosure filed via GitHub issue #3 (https://github.com/dmitriiweb/article-scraper-mcp/issues/3). As an immediate compensating control, operators should apply an allowlist within fetch_article that restricts permitted URL schemes (https only) and validates destination hostnames against an approved domain list, blocking requests to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16) used by cloud metadata services; note that DNS rebinding can bypass host-based checks without resolver-level controls. Alternatively, enforce network egress filtering at the infrastructure layer to prevent the server process from initiating connections to internal subnets and metadata endpoints - this reduces but does not eliminate SSRF risk against external targets. If the fetch_article capability is not operationally required, removing or disabling the MCP tool entirely eliminates this attack surface with no functional trade-off. Monitor for upstream patch publication at https://vuldb.com/cve/CVE-2026-19375.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today