CVE-2026-81093

CVE-2026-81093 is a server-side request forgery (CWE-918) in the get-html-skeleton tool of the affected MCP server: the handler in src/tools/common/get_html_skeleton.ts validated the caller-supplied url argument only syntactically via isValidHttpUrl (src/utils/generic.ts), checking only that the string starts with http/https and parses as a URL, without inspecting the hostname or the address it resolves to. Because loopback, link-local and private-range addresses — including the cloud provider's instance metadata address — passed validation, any caller able to invoke the MCP server could make the web-browser actor fetch an endpoint reachable only from the host, with the fetched document returned in the tool response and therefore readable by the caller. An attacker could thereby read host-local resources and, on cloud-hosted deployments, retrieve instance metadata credentials such as instance tokens; the flaw is rated 8.7 (high) under CVSS 4.0 (network vector, no privileges, high confidentiality impact). All deployments running versions that ship the tool are affected; version 0.9.12 removes the tool entirely. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS puts the 30-day exploitation probability at 0.5% (40th percentile).

What to do: Upgrade the MCP server to version 0.9.12, which removes the vulnerable get-html-skeleton tool, or disable/remove that tool on earlier versions. Restrict which clients can invoke the server, and review host logs for fetches to 169.254.169.254, localhost, or private-range addresses that could indicate metadata credential theft on cloud deployments.