CVE-2025-5276

HighCVSS 7.4

Published: 29/05/2025(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

The mcp-markdownify-server package before version 1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, when processed by the MCP host, triggers webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to send requests to attacker-controlled URLs and read responses, potentially leaking sensitive information.

Risk Assessment

The risk involves potential leakage of sensitive organizational data such as API keys, tokens, or internal information by using the server as a proxy to attack internal network resources.

Recommendation

Immediately update the mcp-markdownify-server package to version 1.0.0 or later, which fixes the vulnerability. Additionally, restrict access to conversion tools to trusted sources and implement URL filtering.

Other vulnerabilities in mcp-markdownify-server

CVE-2025-5273Medium
A vulnerability in the mcp-markdownify-server package before version 1.0.0 allows unauthorized access to files and directories on the server via the get-markdown-file tool. An attacker can craft a malicious prompt that, when processed by the MCP host, enables reading arbitrary files from the system.

Original NVD description (English source)

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS