npm/mcp-markdownify-server CVE-2025-5276: high 7.4, EPSS 0.40%
Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.0.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-frq9-3hp2-xvxg
- https://nvd.nist.gov/vuln/detail/CVE-2025-5276
- https://github.com/zcaceres/markdownify-mcp/commit/0284aa8f34d32c65e20d8cda2d429b7943c9af03
- https://github.com/zcaceres/markdownify-mcp
- https://github.com/zcaceres/markdownify-mcp/blob/224cf89f0d58616d2a5522f60f184e8391d1c9e3/src/server.ts#L20C17-L20C29
- https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249387
CVE-2025-5276 · published · modified · JSON