A vulnerability was determined in adenot mcp-google-search up to 0.3.1. (CVE-2026-19337)
CVE-2026-19337 is a server-side request forgery (SSRF) vulnerability in the adenot mcp-google-search component up to version 0.3.1. It affects an unknown function in the src/index.ts file within the read_webpage component. The vulnerability arises from manipulation of the url argument, allowing SSRF attacks. Exploitation is limited to local execution. The issue has been addressed in a patch identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1. Users are advised to apply this patch to remediate the vulnerability.
AI Analysis
Technical Summary
This vulnerability in adenot mcp-google-search up to version 0.3.1 involves server-side request forgery (CWE-918) due to improper handling of the url argument in the read_webpage component's src/index.ts file. An attacker with local access can manipulate the url parameter to cause the server to make unintended requests. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a low severity impact with low attack vector (local), low complexity, and low privileges required. A patch exists identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1, which should be applied to fix the issue.
Potential Impact
Successful exploitation allows an attacker with local access to perform server-side request forgery, potentially causing the server to make unintended requests. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:L/I:L/A:L). The attack cannot be performed remotely and requires local privileges, reducing the overall risk.
Mitigation Recommendations
A patch identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1 is available and should be applied to remediate this vulnerability. Since the vulnerability requires local execution, restricting local access and applying the patch are effective mitigations. Patch status is confirmed by the presence of the patch commit; no vendor advisory was provided to contradict this.
A vulnerability was determined in adenot mcp-google-search up to 0.3.1. (CVE-2026-19337)
Description
CVE-2026-19337 is a server-side request forgery (SSRF) vulnerability in the adenot mcp-google-search component up to version 0.3.1. It affects an unknown function in the src/index.ts file within the read_webpage component. The vulnerability arises from manipulation of the url argument, allowing SSRF attacks. Exploitation is limited to local execution. The issue has been addressed in a patch identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1. Users are advised to apply this patch to remediate the vulnerability.
CVSS v3.1
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in adenot mcp-google-search up to version 0.3.1 involves server-side request forgery (CWE-918) due to improper handling of the url argument in the read_webpage component's src/index.ts file. An attacker with local access can manipulate the url parameter to cause the server to make unintended requests. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a low severity impact with low attack vector (local), low complexity, and low privileges required. A patch exists identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1, which should be applied to fix the issue.
Potential Impact
Successful exploitation allows an attacker with local access to perform server-side request forgery, potentially causing the server to make unintended requests. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector (C:L/I:L/A:L). The attack cannot be performed remotely and requires local privileges, reducing the overall risk.
Mitigation Recommendations
A patch identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1 is available and should be applied to remediate this vulnerability. Since the vulnerability requires local execution, restricting local access and applying the patch are effective mitigations. Patch status is confirmed by the presence of the patch commit; no vendor advisory was provided to contradict this.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jg2j-2qmx-58vq
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19337"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a7891c8bf8831d539c85ee4
Added to database: 08/09/2026, 14:42:16 UTC
Last enriched: 08/09/2026, 14:45:06 UTC
Last updated: 08/10/2026, 03:40:59 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.