Zcaceres vulnerabilities
We track 3 vulnerabilities in Zcaceres products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on December 10, 2025.
Latest Zcaceres vulnerabilities
- 7.5 High severity
Markdownify Mcp Server: Server-Side Request Forgery
A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP
- 7.5 High severity
Fetch Mcp Server: Server-Side Request Forgery
fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and access internal network resources.
- 7.5 High severity
markdownify-mcp: Improper Neutralization of Special Elements used in a Command
Markdownify is a Model Context Protocol server for converting almost anything to Markdown. Versions below 0.0.2 contain a command injection vulnerability, caused by the unsanitized use of input parameters within a call to child_process.exec, enabling an attack