This vulnerability in imprvhub mcp-browser-agent up to version 0.8.0 allows remote attackers to perform server-side request forgery via crafted inputs to the CallToolRequestSchema function's URL Parameter Handler. By manipulating request parameters, an attacker can cause the server to send unintended requests, potentially accessing internal resources or services. The vulnerability has been publicly disclosed, but the vendor has not issued a fix or advisory. The CVSS 4.0 score of 5.3 reflects a medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems, potentially leading to information disclosure or further network-based attacks. However, the impact is rated medium, and no confirmed exploits are reported in the wild. The lack of vendor response means no official mitigation or patch is currently available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level controls to restrict outbound requests from the affected component and monitor for suspicious activity related to the vulnerable parameters. Avoid exposing the vulnerable functionality to untrusted inputs where possible.