Graphlit Mcp Server
Monthly
Server-side request forgery in graphlit-mcp-server 1.0.1 allows authenticated remote attackers to manipulate the url argument of the fetch function at the ssrf-test endpoint in src/tools.ts, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled destinations including internal network resources. A public proof-of-concept exists via a GitHub issue report; the vendor has not responded to disclosure and no patch has been released. No public exploit indicates active widespread exploitation, but the POC lowers the technical barrier for abuse.
Server-side request forgery in graphlit-mcp-server 1.0.1 allows authenticated remote attackers to manipulate the url argument of the fetch function at the ssrf-test endpoint in src/tools.ts, causing the server to issue arbitrary outbound HTTP requests to attacker-controlled destinations including internal network resources. A public proof-of-concept exists via a GitHub issue report; the vendor has not responded to disclosure and no patch has been released. No public exploit indicates active widespread exploitation, but the POC lowers the technical barrier for abuse.