IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-12-09 22:16

MODIFIED

2025-12-09 22:16

EPSS (Prob. Exploit)

0.45%

Top 62.0%

DATA SOURCES:

NVD 🔗 2025-12-09 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04

> DESCRIPTION

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-8fxj-2g9q-8fjw MODERATE

Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability

AFFECTED PACKAGES:

NPM / mcp-fetch-server

<= 1.0.2

> HISTORIQUE DES MODIFICATIONS

Première apparition

09/12/2025 22:16

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:38

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/Team-Off-course/MCP-Server-Vuln-Analysis/blob/main/CVE-2025-6...