CVE-2026-108583: zotero-mcp 0.10.0 through 0.14.1 SSRF via zotero_add_by_url Tool
zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because fetchembeddedmetadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zoteroaddbyurl, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to steer the agent through prompt injection and induce it to call the zotero_add_by_url tool with an attacker-controlled URL. User interaction is required, and the attack complexity is rated high.
Which internal destinations could an attacker target?
The vulnerable metadata fetch can be directed to loopback, private-network, and link-local hosts. Redirects can also be used to reach those destinations.
What information could be exposed?
Requests to internal services may leak citation meta-tags and error details returned during metadata retrieval.