A local attacker can exploit a server‑side request forgery vulnerability in the A11yServer function of a11y‑mcp. By manipulating input, the server may be forced to send requests to arbitrary URLs. Although the server has no public HTTP interface, the flaw allows a local user or an LLM acting with user approval to redirect the server to malicious resources, potentially exposing internal data or executing further commands. The weakness is a classic SSRF represented by CWE‑918.

Affected products are the a11y‑mcp project released by priyankark, specifically all versions up to and including 1.0.5. No explicit fixed versions are listed for earlier releases, but the project uses a rolling release model and the patch that resolves the issue is present in 1.0.6. Users running any version older than 1.0.6 should consider the product vulnerable.

The CVSS score of 4.8 indicates moderate severity. EPSS data is unavailable and the vulnerability is not in the KEV catalog. Because the attack requires local execution, a compromised local user or an LLM that has been granted permissions can exploit the flaw. Once the server is tricked into making external requests, an attacker could exfiltrate sensitive data or trigger unintended actions on the host, creating a potential pivot point for further attacks. The risk is limited to environments where the a11y‑mcp server is run by untrusted users, but the publicly available exploit means the threat is real.