AI agent vulnerability · Other MCP servers and tools

CVE-2026-7158: mcp-url-downloader has a Server-Side Request Forgery issue

mediumCVSS 4.0 5.5 · 3.1 7.3GHSA-h7xc-4mv8-59fj

A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function validateurlsafe of the file src/mcpurldownloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

Published Apr 27, 2026 · Updated May 6, 2026

Affected packages

mcp-url-downloader

Ecosystem: PyPI
Affected: <= 0.1.0
Fixed in: No patched version yet
Check: pip show mcp-url-downloader

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate_url_safe of the file src/mcp_url_downloader/server.py. Such manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Other MCP servers and tools vulnerabilities

All Other MCP servers and tools entries