Description
A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protocol Handler. The manipulation of the argument URL leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-04-03
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery
Action: Patch Immediately
AI Analysis

Impact

The vulnerability lies in the extractContent function of the Model Context Protocol Handler; manipulating the URL argument causes the server to make internal HTTP requests. This represents a server-side request forgery (SSRF) weakness, categorized as CWE-918, allowing a remote attacker to direct the server to query arbitrary URLs, potentially accessing internal resources or exfiltrating sensitive data.

Affected Systems

The affected product is mixelpixx Google‑Research‑MCP. No specific version numbers are available because the project uses a rolling release model, so any release that includes the vulnerable code may be impacted.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available and the vulnerability is not listed in KEV. Exploitation can be initiated remotely by supplying a crafted URL to the extractContent call, leading the server to send requests to attacker-controlled or internal endpoints. Given the lack of additional constraints, the risk to systems that do not update remains considerable.

Generated by OpenCVE AI on April 3, 2026 at 18:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest update released by mixelpixx for Google‑Research‑MCP
  • Verify that the update removes the SSRF vulnerability; if no update is available, restrict access to the extractContent API to trusted networks

Generated by OpenCVE AI on April 3, 2026 at 18:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 03 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Mixelpixx
Mixelpixx google-research-mcp
Vendors & Products Mixelpixx
Mixelpixx google-research-mcp

Fri, 03 Apr 2026 19:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protocol Handler. The manipulation of the argument URL leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.
Title mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mixelpixx Google-research-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-03T17:32:58.474Z

Reserved: 2026-04-03T07:29:51.893Z

Link: CVE-2026-5470

cve-icon Vulnrichment

Updated: 2026-04-03T17:32:53.241Z

cve-icon NVD

Status : Received

Published: 2026-04-03T16:16:43.787

Modified: 2026-04-03T16:16:43.787

Link: CVE-2026-5470

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-03T21:15:17Z

Weaknesses