Article Scraper Mcp
Monthly
Server-side request forgery in dmitriiweb article-scraper-mcp 1.0.0 allows low-privileged remote attackers to manipulate the `url` argument of the `fetch_article` function in `news_scraper_mcp/server.py`, causing the server to issue arbitrary HTTP requests to internal or external resources. Publicly available exploit code exists via GitHub issue #3, and the maintainer has not responded to responsible disclosure, meaning no patch is currently available. Risk is most significant in cloud-hosted deployments where the server can reach instance metadata services or internal network segments.
Server-side request forgery in dmitriiweb article-scraper-mcp 1.0.0 allows low-privileged remote attackers to manipulate the `url` argument of the `fetch_article` function in `news_scraper_mcp/server.py`, causing the server to issue arbitrary HTTP requests to internal or external resources. Publicly available exploit code exists via GitHub issue #3, and the maintainer has not responded to responsible disclosure, meaning no patch is currently available. Risk is most significant in cloud-hosted deployments where the server can reach instance metadata services or internal network segments.