https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T12:29:09.980249+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-108583 CVE-2026-108583 — zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool 2026-10-11T12:29:09.982059+00:00

Affected: 54yyyu zotero-mcp

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.