The graphlit graphlit-mcp-server version 1.0.1 contains a server-side request forgery vulnerability in the fetch function of src/tools.ts, specifically in the ssrf-test endpoint. By manipulating the url argument, an attacker can cause the server to make unintended requests, potentially accessing internal resources or services. The vulnerability is remotely exploitable without user interaction and requires low privileges. The project has been informed but has not issued a fix or mitigation guidance. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability could allow an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal or protected resources. This could lead to information disclosure or further attacks depending on the internal network configuration. However, no confirmed active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the vulnerable endpoint or implementing network-level controls to limit outbound requests from the server.