Threats tagged 'ghsa-rc65-6pgw-cw9c'

zotero-mcp versions 0.10.0 through 0.14.1 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to manipulate the _fetch_embedded_metadata function to fetch URLs without validating the destination, potentially accessing internal services. Attackers can use prompt injection to trigger zotero_add_by_url, causing requests to internal or link-local hosts, which may leak citation metadata and error information. The vulnerability has a low severity score and no known exploits in the wild.