Cowork Bench
Monthly
Server-side request forgery in the pdf-tools-mcp MCP server bundled with the 0717376/cowork_bench project lets an attacker who can call its ControlFlowNode tool supply a crafted pdf_file_path argument and cause the server to issue requests to attacker-chosen destinations, yielding low confidentiality, integrity, and availability impact. The repository is a rolling-release personal project with no tagged versions, so all revisions up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d are presumed affected, and the CVSS 4.0 vector (PR:L, E:P) indicates the tool interface requires some authenticated or privileged access rather than fully anonymous reach. Publicly available exploit code exists (published in a separate GitHub proof-of-concept repository), but there is no evidence of confirmed active exploitation, and the practical risk is heavily constrained by the product's negligible deployment footprint and the maintainer's failure to respond to the original issue report.
Server-side request forgery in the pdf-tools-mcp MCP server bundled with the 0717376/cowork_bench project lets an attacker who can call its ControlFlowNode tool supply a crafted pdf_file_path argument and cause the server to issue requests to attacker-chosen destinations, yielding low confidentiality, integrity, and availability impact. The repository is a rolling-release personal project with no tagged versions, so all revisions up to commit d943e75bc0fc8e3b27141979300cd8cbcd1e890d are presumed affected, and the CVSS 4.0 vector (PR:L, E:P) indicates the tool interface requires some authenticated or privileged access rather than fully anonymous reach. Publicly available exploit code exists (published in a separate GitHub proof-of-concept repository), but there is no evidence of confirmed active exploitation, and the practical risk is heavily constrained by the product's negligible deployment footprint and the maintainer's failure to respond to the original issue report.