Mcp Webresearch
Monthly
Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.
Server-side request forgery in the mcp-webresearch MCP server (version 0.1.7, package @mzxrai/mcp-webresearch) lets remote attackers reach internal-only network services by feeding loopback, link-local, or cloud metadata addresses to the visit_page tool. Because the tool validates only the URL scheme and never filters private or reserved IP ranges, an attacker who influences the LLM-controlled URL - typically via prompt injection - can drive the server's Playwright browser to endpoints like 169.254.169.254 and exfiltrate credentials and other sensitive internal content back into the model context. No public exploit identified at time of analysis, though a detailed technical write-up exists and the issue is disclosed by VulnCheck; there is no CISA KEV listing.