Evidence · DiggingBeagle record
HaiND: zotero-mcp generic webpage metadata SSRF
Original researcher description pinned to zotero-mcp v0.14.1 and commit 0faf1b25. The generic zotero_add_by_url metadata path uses requests.get without URL destination restrictions or redirect checks; writable Zotero backend and a model-selected URL are prerequisites. Researcher limits readback to recognized citation fields and distinguishes the earlier fixed OA-PDF sink.
- Publisher
- Nguyen Dinh Hai (HaiND)
- Source role
- primary disclosure
Evidence record
Original researcher description pinned to zotero-mcp v0.14.1 and commit 0faf1b25. The generic zotero_add_by_url metadata path uses requests.get without URL destination restrictions or redirect checks; writable Zotero backend and a model-selected URL are prerequisites. Researcher limits readback to recognized citation fields and distinguishes the earlier fixed OA-PDF sink.
Claim-level citations (4)
- supportszotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583): A separate June 8, 2026 issue described an SSRF in the DOI open-access PDF download path; the zotero-mcp maintainer stated that PR 327 added destination validation and per-hop redirect checks and closed that issue. The October generic metadata path is a different fetch sink.
Root cause section 5 and References identifying the already guarded PDF path
- supportszotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583): Nguyen Dinh Hai reports that zotero_add_by_url invokes _fetch_embedded_metadata for generic webpages and fetches the supplied URL using requests.get without private-destination validation or redirect re-checks.
Root cause sections 1-3, _fetch_embedded_metadata at write.py:2035-2090
- supportszotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583): The described SSRF is conditional on an exposed write-capable Zotero tool and reachable destination; the potential readback is limited to parsed citation metadata rather than arbitrary raw HTTP response bodies, and no end-to-end hostile agent compromise is established.
Summary, Attack flow, Impact and limits; writable-client gate and recognized citation meta-tags
- supportszotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583): The original researcher characterizes the investigation as source-level and says it did not execute an end-to-end SSRF against private network services; the published write-up contains a local loopback example, so no broader exploit outcome should be inferred.
Verification section and Impact and limits; local example and no end-to-end SSRF caveat