Executive brief
Markdownify MCP Server is a component that converts web pages and search results to markdown format. An attacker can trick the MCP host into making requests to arbitrary URLs by crafting specially-crafted prompts, potentially exposing sensitive information from internal systems or services that the server can reach.
Technical details
The vulnerability is a Server-Side Request Forgery (CWE-918) in the Markdownify.get() function that processes user-supplied URLs without proper validation. An attacker can craft malicious prompts that invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests to attacker-controlled URLs and read the responses. The attack requires user interaction (the MCP host must access the attacker-supplied prompt) but has no authentication requirements. An attacker can leverage this to access internal resources, read sensitive data from internal services, or perform reconnaissance on the network. A fix incorporating URL validation has been merged (commit 0284aa8).
Affected products
- <UNKNOWN> mcp-markdownify-server 0.0.1 and earlier (all previous versions)
Timeline
- 2025-05-29: disclosed