This vulnerability involves server-side request forgery in the HTTP Request Handler component of mcp-data-vis, specifically in the axios function of src/servers/web-scraper/server.js. An attacker can remotely exploit this flaw to cause the server to make unintended HTTP requests. The vulnerability was reported early to the project but remains unpatched. Due to the rolling release nature of the software, no fixed version or patch is currently identified. No known exploits are reported in the wild as of the publication date.

Successful exploitation could allow an attacker to induce the server to send crafted HTTP requests to internal or external systems, potentially bypassing network restrictions or accessing sensitive internal resources. The CVSS score of 6.9 reflects a medium impact, with low to limited confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the project repository and issue tracker for updates or patches. Until a fix is released, consider implementing network-level controls to restrict outbound HTTP requests from the affected server to limit potential SSRF exploitation.