7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5276

CVE-2025-5276: Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function

All versions of the package mcp-markdownify-server are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() function. An attacker can craft a prompt that, once accessed by the MCP host, can invoke the webpage-to-markdown, bing-search-to-markdown, and youtube-to-markdown tools to issue requests and read the responses to attacker-controlled URLs, potentially leaking sensitive information.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5276

CVE-2025-5276:

7.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mcp-markdownify-server	npm	<= 0.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-5276) is a Server-Side Request Forgery (SSRF) in mcp-markdownify-server. The core issue is insufficient validation of user-supplied URLs before the server makes requests to these URLs.

The vulnerability description explicitly identifies Markdownify.get() as the vulnerable function. This function likely serves as an entry point that processes user input and can invoke various tools.

The provided patch (commit 0284aa8f34d32c65e20d8cda2d429b7943c9af03) modifies the createServer() function in src/server.ts. Specifically, it adds URL validation (checking for allowed schemes like 'http:', 'https:' and using is_ip_private to block requests to private IP addresses) for the WebpageToMarkdownTool. This indicates that, prior to the patch, createServer() would pass unvalidated URLs from user input to the Markdownify.toMarkdown() function when this tool was invoked.

Therefore, three key functions are involved in the vulnerability:

Markdownify.get(): The primary entry point mentioned in the CVE, which processes potentially malicious prompts.
createServer(): This function, in its pre-patch state, contained the flawed logic for the WebpageToMarkdownTool where it failed to validate URLs.
Markdownify.toMarkdown(): This function performs the actual fetching of the URL content. When supplied with an unvalidated, malicious URL by createServer(), it executes the SSRF attack.

During exploitation, these functions would likely appear in a runtime profile or stack trace. The patch addresses the vulnerability for one specific tool (WebpageToMarkdownTool) by adding checks in createServer(). The vulnerability description also mentions bing-search-to-markdown and youtube-to-markdown tools; if these are also invoked via Markdownify.get() and make external requests without similar validation, they might also be vulnerable, though the provided patch does not cover them.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.