The vulnerability is a server‑side request forgery (SSRF) in the read_webpage function of adenot mcp‑google‑search. An attacker can supply a crafted URL argument that causes the server to issue HTTP requests to arbitrary destinations. Based on the description, it is inferred that this could enable the attacker to access internal resources or external services that the server has connectivity to, potentially exposing sensitive data. The flaw does not provide remote code execution or unmanaged privileges on the host.

The flaw exists in adenot mcp‑google‑search up to version 0.3.1. No other vendors or products are listed. The vulnerable code resides in src/index.ts of the read_webpage component. Users running this version face the SSRF vulnerability unless they apply the patch or upgrade.

The CVSS score of 4.8 indicates moderate potential impact. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that exploitation has not yet been observed in the wild. The attack is limited to local execution, so only users with access to the application server can exploit the flaw. Given the moderate CVSS, lack of public exploits, and local attack surface, the overall risk is considered manageable but should be remediated promptly.