The vulnerability in wonderwhy-er DesktopCommanderMCP 0.2.37 allows an attacker to perform server-side request forgery via the readFileFromUrl function in the read_file component. By manipulating the URL parameter, an attacker can cause the server to make unintended requests. The vulnerability is remotely exploitable and has a CVSS 4.0 score of 5.3 (medium severity). A patch exists, identified by commit 53699bebba9950047bca16ac4dc8f0568f596aaa, which should be applied to mitigate the risk.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services not otherwise accessible. The CVSS score of 5.3 reflects a medium impact, with low complexity and no user interaction required. There are no reports of active exploitation in the wild.

A patch is available for this vulnerability, identified by the commit hash 53699bebba9950047bca16ac4dc8f0568f596aaa. It is recommended to apply this patch promptly to remediate the issue. Since this is not a cloud service, remediation depends on the user applying the patch. No vendor advisory was provided to indicate alternative mitigations or that no action is required.