CVE-2025-65512
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to internal network services.
Risk Assessment
An attacker could access internal network services, potentially leading to information disclosure or further attacks.
Recommendation
Update markdownify-mcp to a patched version or restrict URL conversion capabilities and verify IP address validation.
Other vulnerabilities in markdownify-mcp
Original NVD description (English source)
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to internal network services.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS