CVE-2025-5276 describes an SSRF vulnerability in the mcp-markdownify-server package prior to version 1.0.0. The vulnerability arises from the Markdownify.get() function, which can be manipulated by an attacker to invoke webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools. These tools issue HTTP requests and return responses from URLs specified by the attacker, potentially exposing sensitive data accessible to the server. The CVSS 4.0 score is 8.2 (high severity), indicating network attack vector, low attack complexity, no privileges required, user interaction needed, and high confidentiality impact.

An attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to arbitrary URLs controlled by the attacker. This can lead to unauthorized disclosure of sensitive information accessible to the server, such as internal network resources or data returned by the invoked tools. There is no indication of privilege escalation or integrity/availability impact. No known exploits in the wild have been reported.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid using vulnerable versions of mcp-markdownify-server or restrict access to the Markdownify.get() function to trusted users only. Monitoring for suspicious activity involving this function is recommended.