Junglewise Threat Intelligence

CVE-2025-5276: Markdownify MCP Server Server-Side Request Forgery in webpage and search tools

CVE-2025-5276 · Severity: low · CVSS 3.1 · Published 2025-05-29

Technologies: mcp-markdownify-server (npm). Vendors: Unknown, npm.

Executive brief

Markdownify MCP Server is a component that converts web pages and search results to markdown format. An attacker can trick the MCP host into making requests to arbitrary URLs by crafting specially-crafted prompts, potentially exposing sensitive information from internal systems or services that the server can reach.

Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) in the Markdownify.get() function that processes user-supplied URLs without proper validation. An attacker can craft malicious prompts that invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests to attacker-controlled URLs and read the responses. The attack requires user interaction (the MCP host must access the attacker-supplied prompt) but has no authentication requirements. An attacker can leverage this to access internal resources, read sensitive data from internal services, or perform reconnaissance on the network. A fix incorporating URL validation has been merged (commit 0284aa8).

Affected products

  • <UNKNOWN> mcp-markdownify-server 0.0.1 and earlier (all previous versions)

Timeline

  • 2025-05-29: disclosed

References

Related threats