The vulnerability in dmitriiweb article-scraper-mcp 1.0.0 arises from improper validation or sanitization of the url parameter in the fetch_article function within news_scraper_mcp/server.py. This allows an attacker to craft a malicious URL that the server will fetch, enabling server-side request forgery. The issue was reported early to the project but remains unaddressed. The vulnerability is remotely exploitable and public exploit code exists.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal resources or services not otherwise exposed. The CVSS score of 5.3 indicates a medium impact, with low complexity and no required privileges or user interaction. No evidence of active exploitation in the wild is currently known.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's channels for updates. In the meantime, restricting outbound HTTP requests from the server or implementing input validation and URL allowlisting may reduce risk.