A vulnerability has been found in dmitryglhf mcp-url-downloader up to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. Affected by this issue is the function _validate…

A server-side request forgery (SSRF) vulnerability has been discovered in dmitryglhf mcp-url-downloader up to commit 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6. The vulnerability affects the _validate_url_safe function in src/mcp_url_downloader/server.py, where manipulation of the url argument leads to SSRF. The attack can be executed remotely and the exploit has been publicly disclosed. The project uses rolling releases making version tracking unavailable. The maintainer was notified through an issue report but has not responded yet.