software · DiggingBeagle record
zotero-mcp
MCP integration for Zotero bibliographic workflows, including the generic add-by-URL metadata path examined in CVE-2026-108583.
- Entity kind
- software
Record description
zotero-mcp exposes citation research and library operations to MCP clients. An October 2026 source-level disclosure reported that the generic webpage importer in versions 0.10.0 through 0.14.1 can request an untrusted URL without private-destination and redirect restrictions. The invoked tool needs a write-capable Zotero backend, and any readback is constrained by metadata parsing and later item access. This path is separate from a DOI/open-access PDF-fetch SSRF discussed in June issue 326, for which maintainers reported a fix. No verified real-world exfiltration or patch for the October path is established in the authorized sources.