The vulnerability resides in the _fetch_embedded_metadata routine of zotero-mcp 0.10.0 to 0.14.1, which accepts user‑supplied URLs without validating their destination. An attacker can trick the tool into fetching a URL by injecting a malformed prompt into the zotero_add_by_url routine. This causes the tool to perform HTTP or HTTPS requests to loopback, private, or link‑local hosts, exposing internal service responses and error messages as citation meta‑tags. The impact is primarily information disclosure of internal infrastructure, rather than arbitrary code execution or denial of service. The weakness is classified as CWE‑918. The vulnerability allows attackers to learn about internal hostnames, IP addresses, and the presence of services, which could aid further attacks.

All versions of zotero-mcp from 0.10.0 through 0.14.1 produced by 54yyyu are affected. If an environment runs any of these releases, the SSRF flaw is present.

The CVSS score is 2.3, indicating a low overall risk from a purely technical standpoint. The EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence the entry of a URL into the zotero_add_by_url call, which normally occurs via user input. While the attack surface may be limited to environments where an attacker can supply such input, the potential for internal exposure makes mitigation prudent. The attack vector is inferred to be local or remote injection of malicious prompts that are processed by the tool, leading to uncontrolled outbound requests. This risk is moderate given the lack of code execution but could be leveraged as a reconnaissance step.