The markdownify-mcp tool is affected by a critical Server-Side Request Forgery vulnerability that permits unauthenticated attackers to reach internal network resources.

This SSRF flaw resides in the webpage-to-markdown conversion feature, where the application fails to properly validate destination hostnames or handle HTTP redirects. An unauthenticated attacker can exploit this to perform requests against internal infrastructure that would otherwise be protected by network boundaries.

The ability for an unauthorized party to scan or interact with internal network services poses a significant risk to organizational confidentiality. A successful exploit could lead to the exposure of sensitive internal data or provide a foothold for lateral movement within the network. With a CVSS score of 7.5, this vulnerability is classified as High severity and requires immediate attention to prevent unauthorized internal access.

Immediate Action: Since a specific patch is not currently identified, users should restrict the network access of the host running markdownify-mcp to only necessary external endpoints. Monitor vendor channels for the release of an updated version that implements strict URL validation and blocks requests to private IP ranges.

Proactive Monitoring: Review web server and network egress logs for requests originating from the markdownify-mcp instance targeting internal IP addresses or reserved network blocks.

Compensating Controls: Deploy a Web Application Firewall or an egress proxy policy to filter and block requests directed at internal network ranges (such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16).

Public Exploit Available: Yes, a published PoC exists, as documented in the referenced security analysis by the research team.

Given the availability of a proof-of-concept and the high severity of the vulnerability, organizations should treat this as a priority. While waiting for a formal vendor patch, ensure that the deployment environment is hardened against unauthorized egress traffic to minimize the potential for internal network reconnaissance.