mcp-url-downloader up to commit 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6 (version <=0.1.0) contains a server-side request forgery (SSRF) vulnerability in the _validate_url_safe function of src/mcp_url_downloader/server.py. This vulnerability allows remote attackers to manipulate the URL argument to cause the server to make unintended requests. The vulnerability has been publicly disclosed, and exploit code is available. The project uses a rolling release model, so specific fixed versions are not identified, and the vendor has not yet responded with a patch or mitigation guidance.