This vulnerability affects the extractContent function in the content-extractor.service.ts file of the Model Context Protocol Handler component in mixelpixx Google-Research-MCP. An attacker can manipulate the URL argument to perform server-side request forgery, potentially causing the server to make unauthorized requests. The issue is remotely exploitable and has been publicly disclosed. The product follows a rolling release update model, so no fixed version details are available. The vendor has not responded to the disclosure, and no official remediation or patch information is provided.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the affected server to make arbitrary HTTP requests, potentially leading to unauthorized access to internal resources or information disclosure. However, the CVSS score of 5.3 (medium severity) and the lack of known exploits in the wild suggest the impact is moderate. No direct evidence of further compromise or privilege escalation is indicated in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should monitor for updates from mixelpixx. Until a fix is released, consider restricting or validating URLs passed to the extractContent function to mitigate SSRF risk.