Scrapling Fetch Mcp
Monthly
Server-side request forgery in scrapling-fetch-mcp versions through 0.2.2 allows an authenticated user of an MCP-enabled AI assistant to supply arbitrary URL schemes - such as file://, gopher://, or dict:// - to the s_fetch_page and s_fetch_pattern tool functions, causing the server to issue requests to internal or local resources on behalf of the attacker. The root cause is the absence of any URL scheme validation before passing user-controlled input to the underlying browse_url call in _fetcher.py. No public exploit code or active exploitation has been identified; version 0.2.3 patches the issue.
Server-side request forgery in scrapling-fetch-mcp versions through 0.2.2 allows an authenticated user of an MCP-enabled AI assistant to supply arbitrary URL schemes - such as file://, gopher://, or dict:// - to the s_fetch_page and s_fetch_pattern tool functions, causing the server to issue requests to internal or local resources on behalf of the attacker. The root cause is the absence of any URL scheme validation before passing user-controlled input to the underlying browse_url call in _fetcher.py. No public exploit code or active exploitation has been identified; version 0.2.3 patches the issue.