This vulnerability in adenot mcp-google-search up to version 0.3.1 allows an attacker with local access to manipulate the url argument in a function of the read_webpage component (src/index.ts), resulting in server-side request forgery (SSRF). SSRF could enable the attacker to make unauthorized requests from the server. The issue is fixed in a patch referenced by commit f071d491b685011ca04e8ab8d586fc65f86bcee1. No public exploits are known, and the attack requires local privileges.

An attacker with local access can exploit this SSRF vulnerability to cause the server to make arbitrary requests. This could potentially be used to access internal resources or services not otherwise accessible. However, the attack is limited to local execution, reducing the risk of remote exploitation. No known active exploitation has been reported.

A patch identified by commit f071d491b685011ca04e8ab8d586fc65f86bcee1 is available and should be applied to correct this vulnerability. Since the vulnerability requires local access, restricting local user privileges and access can also reduce risk. Patch status is not explicitly confirmed in a vendor advisory; therefore, verify the patch availability and apply it accordingly.