CVE-2026-19375
Received Received - Intake

Server-Side Request Forgery in article-scraper-mcp

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulDB

Description
A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetch_article of the file news_scraper_mcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-19375
EUVD
EUVD-2026-54963

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dmitriiweb article-scraper-mcp 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the article-scraper-mcp tool version 1.0.0. It occurs in the fetch_article function of news_scraper_mcp/server.py where the url parameter is not properly validated. Attackers can manipulate this parameter to send HTTP requests to internal services, localhost, private networks, or cloud metadata endpoints from the server's network context.

Detection Guidance

To detect SSRF in article-scraper-mcp, monitor outbound HTTP requests from the server, especially to localhost, private IPs, or unexpected domains. Check server logs for requests to the fetch_article endpoint with manipulated URLs. Use network tools like tcpdump or Wireshark to inspect traffic. Test by sending a request to a controlled internal server or using curl to probe internal endpoints via the vulnerable URL parameter.

Impact Analysis

The SSRF vulnerability allows attackers to probe internal networks, access internal services, expose cloud metadata, or send callbacks to attacker-controlled infrastructure. This could lead to data breaches, unauthorized access to sensitive systems, or further network compromise from the server's network context.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to internal services or sensitive data, which may violate GDPR's data protection principles if personal data is exposed. For HIPAA, it could risk unauthorized access to protected health information if internal systems are compromised.

Mitigation Strategies

Immediately disable or restrict access to the fetch_article function. Implement strict URL validation to block localhost, private IPs, and cloud metadata endpoints. Use allowlists for permitted domains. Update the validate_url() function to enforce host restrictions and disable redirects. Monitor for exploit attempts in logs. Consider patching or replacing the tool until a fix is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19375. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart