Evidence · DiggingBeagle record
zotero-mcp issue 326 and maintainer remediation of OA-PDF SSRF
June 8, 2026 security-review issue about a distinct _download_and_attach_pdf/DOI open-access PDF SSRF and other hardening findings. Maintainer says PRs 327 and 328 fixed those issues, including PDF URL validation and per-hop redirect checking; this does not establish a fix for the later generic webpage metadata sink.
- Published
- Jun 8, 2026
- Publisher
- elfrost and zotero-mcp maintainer
- Source role
- primary disclosure
Evidence record
June 8, 2026 security-review issue about a distinct _download_and_attach_pdf/DOI open-access PDF SSRF and other hardening findings. Maintainer says PRs 327 and 328 fixed those issues, including PDF URL validation and per-hop redirect checking; this does not establish a fix for the later generic webpage metadata sink.
Claim-level citations (1)
- supportszotero-mcp generic URL importer could reach internal hosts (CVE-2026-108583): A separate June 8, 2026 issue described an SSRF in the DOI open-access PDF download path; the zotero-mcp maintainer stated that PR 327 added destination validation and per-hop redirect checks and closed that issue. The October generic metadata path is a different fetch sink.
Issue #326, first SSRF section and maintainer June 8 comment listing fixes from PR #327