This vulnerability exists in the ControlFlowNode function of the pdf_tools_mcp component within the 0717376 cowork_bench project. By manipulating the pdf_file_path argument, an attacker can cause the server to make unintended requests, constituting a server-side request forgery (SSRF). The vulnerability can be exploited remotely without user interaction and has a CVSS 4.0 base score of 5.3 (medium). The project employs a rolling release model, so no discrete version numbers are available for affected or patched releases. The project has been informed but has not yet issued a response or patch.

Successful exploitation allows an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not otherwise reachable. This could lead to information disclosure or further attacks depending on the server environment. The vulnerability is remotely exploitable without user interaction and has a medium severity rating.

No official fix or patch has been released yet, and the project has not responded to the issue report. Since the project uses a rolling release model, users should monitor the project's repository or issue tracker for updates or patches addressing this vulnerability. Until a fix is available, consider restricting access to the vulnerable functionality or applying network-level controls to limit outbound requests from the server.