CVE-2026-81093High· 8.6▾ Twilight

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score47/ 100 · Moderate

impact 47.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 27, 2026

Updated

Sep 24, 2026

CVSS

8.6

Vendor

—

Product

—

CWE

CWE-918

Depth score

47 · Moderate

EPSS

0.52% · p42

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 28 days

Aug 27, 2026Published
Disclosed via NVD
Sep 24, 2026Record revised
Last analysed / modified upstream
Sep 24, 2026EPSS first tracked
0.5%

CWE-918 #nvd

Full technical detail▾

Overview

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed