scrapling-fetch-mcp EUVD-2026-67301

Exploitation requires the attacker to hold authenticated, low-privilege access to an AI assistant or agent framework that has scrapling-fetch-mcp configured and active as an MCP tool (consistent with PR:L in the CVSS vector). The vulnerable code path is reached only when s_fetch_page or s_fetch_pattern is invoked with a non-HTTP/HTTPS URL - standard http:// and https:// requests are not affected. Deployments that do not expose an MCP server, or that restrict which users can invoke MCP tools, are not at practical risk. The CVSS UI:P metric indicates passive user interaction is required, consistent with the MCP session invocation model. Impact is limited to low confidentiality (VC:L) - the attacker can cause the server to fetch and return internal resource content, but cannot write data or cause denial of service.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores 5.1 (Medium), correctly capturing that exploitation requires low-privilege authenticated access to the MCP-enabled system and yields only limited confidentiality exposure - the server can be made to read internal resources, but there is no integrity or availability impact. No EPSS score was provided in the available data, and the CVE is not listed in the CISA KEV catalog, meaning active exploitation is unconfirmed. No public POC has been identified. The realistic threat surface is narrow: the attacker must already be an authenticated participant in an AI assistant session that has this specific MCP plugin configured, which substantially limits opportunistic mass exploitation. The CVSS UI:P metric (passive user interaction in CVSS 4.0) is consistent with the MCP invocation model, where a tool call must be triggered within an assistant session. Overall this is a genuine but contained medium-severity issue - organizations running MCP-enabled AI infrastructure with this plugin should upgrade promptly, but the absence of KEV listing and the PR:L prerequisite keep it out of emergency-patch territory.

An attacker authenticated to an AI assistant that has scrapling-fetch-mcp loaded calls s_fetch_page with a URL such as file:///etc/passwd or http://169.254.169.254/latest/meta-data/ (AWS instance metadata endpoint). Because no scheme validation existed in versions through 0.2.2, browse_url processes the request and returns the file contents or cloud metadata to the caller. No public POC has been identified, but the attack pattern requires only knowledge of SSRF technique and access to the MCP tool.