# CVE-2025-5276: Markdownify MCP Server Server-Side Request Forgery in webpage and search tools

Source: https://junglewise.ai/threats/cve-2025-5276-markdownify-mcp-server-server-side-request-forgery-in-webpage-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-5276 · Severity: low · CVSS 3.1 · Published 2025-05-29

Markdownify MCP Server is a component that converts web pages and search results to markdown format. An attacker can trick the MCP host into making requests to arbitrary URLs by crafting specially-crafted prompts, potentially exposing sensitive information from internal systems or services that the server can reach.

Technologies: [mcp-markdownify-server (npm)](https://junglewise.ai/threats/technologies/mcp-markdownify-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-5276 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-5276 being exploited in the wild.

**How severe is CVE-2025-5276?** Low severity, with a CVSS score of 3.1, published 29 May 2025.

**Which products and versions are affected?** mcp-markdownify-server (npm) SEMVER:introduced=0,last_affected=0.0.1.

**Is there a fix for CVE-2025-5276?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-5276 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-5276?** Check whether you run mcp-markdownify-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Request Forgery (CWE-918) in the Markdownify.get() function that processes user-supplied URLs without proper validation. An attacker can craft malicious prompts that invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests to attacker-controlled URLs and read the responses. The attack requires user interaction (the MCP host must access the attacker-supplied prompt) but has no authentication requirements. An attacker can leverage this to access internal resources, read sensitive data from internal services, or perform reconnaissance on the network. A fix incorporating URL validation has been merged (commit 0284aa8).

## Affected products

- <UNKNOWN> mcp-markdownify-server 0.0.1 and earlier (all previous versions)

## Identifiers

- CVE-2025-5276
- GHSA-frq9-3hp2-xvxg

## Timeline

- 2025-05-29: disclosed

## References

- [https://github.com/zcaceres/markdownify-mcp/commit/0284aa8f34d32c65e20d8cda2d429b7943c9af03](https://github.com/zcaceres/markdownify-mcp/commit/0284aa8f34d32c65e20d8cda2d429b7943c9af03)

## Related threats

- [mcp-markdownify-server command injection in pptx-to-markdown](https://junglewise.ai/threats/cve-2025-58358-mcp-markdownify-server-command-injection-in-pptx-to-markdown)
- [Markdownify MCP Server arbitrary file read in get-markdown-file tool](https://junglewise.ai/threats/cve-2025-5273-markdownify-mcp-server-arbitrary-file-read-in-get-markdown-file)