EUVD-2026-25905Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, unauthenticated SSRF with partial CIA impact on the vulnerable system and no confirmed scope change to other systems.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A security vulnerability has been detected in AlejandroArciniegas mcp-data-vis up to de5a51525a69822290eaee569a1ab447b490746d. Affected by this vulnerability is the function axios of the file src/servers/web-scraper/server.js of the component HTTP Request Handler. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in AlejandroArciniegas mcp-data-vis allows unauthenticated remote attackers to cause the server to issue arbitrary outbound HTTP requests via the axios-based HTTP Request Handler in src/servers/web-scraper/server.js. Attackers can leverage this to probe internal network services, cloud metadata endpoints, or bypass perimeter controls from the server's network context. A public proof-of-concept exploit exists (SSVC: poc, Automatable: yes), though EPSS remains low at 0.04% (12th percentile), consistent with the tool's obscure deployment footprint.
Technical ContextAI
mcp-data-vis is a Model Context Protocol (MCP) server providing web-scraping and data visualization capabilities, likely used within AI-assisted workflows. The vulnerable component is the axios HTTP client call within src/servers/web-scraper/server.js, where user-supplied URLs are passed to axios for outbound HTTP requests without adequate validation or allowlist enforcement. The root cause class is CWE-918 (Server-Side Request Forgery), a well-understood category where the server acts as an uncontrolled proxy for attacker-directed requests. The affected commit is de5a51525a69822290eaee569a1ab447b490746d; the project uses a rolling release model with no formal versioning, making patch tracking solely commit-based. No formal CPE string has been published.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer had not responded to the coordinated disclosure at the time of publication per the CVE description. The most actionable immediate compensating control is to restrict outbound network egress from the host running mcp-data-vis using firewall rules or security group policies, explicitly blocking access to cloud metadata endpoints (e.g., 169.254.169.254, fd00:ec2::254) and private RFC-1918 address ranges; this limits SSRF pivot reach at the cost of potentially breaking legitimate scraping targets in those ranges. A second control is to avoid exposing the mcp-data-vis HTTP server directly to untrusted networks - restrict access to localhost or a trusted developer subnet. Users may also fork the repository and apply an allowlist or blocklist URL validation step in src/servers/web-scraper/server.js before the axios call, rejecting internal address ranges and private hostnames. Monitor the upstream issue at https://github.com/AlejandroArciniegas/mcp-data-vis/issues/1 and VulDB entry https://vuldb.com/vuln/359745 for any maintainer response or patch release.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today