CVE-2026-81848
Deferred Deferred - Pending Action

Server-Side Request Forgery in cyberchitta Scrapling-Fetch-MCP

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulDB

Description
A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgrading to version 0.2.3 is sufficient to resolve this issue. This patch is called 9f6f34e92c55c3d95566ad9c62aca7327d24533a. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-81848
EUVD
EUVD-2026-67301

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cyberchitta scrapling-fetch-mcp 0.2.3
cyberchitta scrapling-fetch-mcp to 0.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) issue in the cyberchitta scrapling-fetch-mcp tool up to version 0.2.2. The flaw allows attackers to manipulate URL inputs in the s_fetch_page and s_fetch_pattern functions to perform unauthorized requests or access local files via schemes like file://. The attack can be executed remotely without requiring authentication.

Detection Guidance

Check if the installed version of scrapling-fetch-mcp is below 0.2.3. Run: pip show scrapling-fetch-mcp or pip list | grep scrapling-fetch-mcp. If version is 0.2.2 or lower, the system is vulnerable.

Impact Analysis

An attacker could exploit this to read sensitive files on your system such as configuration files, SSH keys, or system files like /etc/passwd. They could also make unauthorized requests to internal services, potentially leading to data leaks or further network compromise. The impact depends on the privileges of the user running the tool.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using this tool may face compliance violations if sensitive data is exposed due to the flaw.

Mitigation Strategies

Upgrade scrapling-fetch-mcp to version 0.2.3 or later. Run: pip install --upgrade scrapling-fetch-mcp. This version restricts URL schemes to http and https only, preventing file:// URL exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart