CVE-2026-19375 describes a server-side request forgery vulnerability in the fetch_article function of the news_scraper_mcp/server.py file in dmitriiweb article-scraper-mcp version 1.0.0. The vulnerability arises from improper validation or sanitization of the url argument, allowing remote attackers to cause the server to make arbitrary HTTP requests. This can lead to information disclosure or other impacts associated with SSRF. The vulnerability was responsibly disclosed but remains unpatched as of the latest information. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server perform unauthorized requests to internal or external systems. This may lead to limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, no active exploitation in the wild has been reported to date.

No official fix or patch is currently available for this vulnerability. Users should monitor the project for updates or patches. Until a fix is released, consider implementing network-level controls to restrict outbound requests from the affected server or apply input validation and sanitization on the url parameter if possible. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.