Vulnerabilities

TI-2026-12394 CVE-2026-14702 · GHSA-cf27-pvxx-xmcj

zcaceres markdownify-mcp webpage-to-markdown Markdownify.ts saveToTempFile random values

MEDIUM 44

A flaw has been found in zcaceres markdownify-mcp up to 1.1.0.

CVSS 4.0LOW 2.0 Local Low privileges No interaction EPSS 0.00144 Published 2026-07-05 No fix listed CWE-310

TI-2026-12391 CVE-2026-14699 · GHSA-mf9r-r6pc-8fc6

zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink

LOW 21

A weakness has been identified in zcaceres markdownify-mcp up to 1.1.0.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00174 Published 2026-07-05 No fix listed CWE-59

TI-2025-40380 CVE-2025-65512 · GHSA-pfj3-mmxr-4rjh

A Server-Side Request Forgery (SSRF) vulnerability was discovered in the…

HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00525 Published 2025-12-10 No fix listed CWE-918

TI-2025-40381 CVE-2025-65513 · GHSA-8fxj-2g9q-8fjw

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF)…

HIGH 72

fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00448 Published 2025-12-09 No fix listed CWE-918

TI-2025-36147 CVE-2025-58358 · GHSA-45qj-4xq3-3c45

Markdownify is vulnerable to command injection through pptx-to-markdown tool

HIGH 68

Markdownify is a Model Context Protocol server for converting almost anything to Markdown.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00965 Published 2025-09-04 Fixed in 0.0.2 CWE-77