Vulnerability · Published Aug 27, 2026 · Assigned by VulDB

CVE-2026-81848cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery

Low 3.5

In plain English

A low-severity server-side request forgery in scrapling-fetch-mcp from cyberchitta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. Upgrading to version 0.2.3 is sufficient to resolve this issue. This patch is called 9f6f34e92c55c3d95566ad9c62aca7327d24533a. Upgrading the affected component is advised.

Affected products (as reported)

Vendor	Product	Versions
cyberchitta	scrapling-fetch-mcp	0.2.00.2.10.2.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C

References

VDB-396173 | cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery vdb-entry, technical-description
VDB-396173 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-81848 | CVE Analysis and Report third-party-advisory
Submit #887256 | cyberchitta scrapling-fetch-mcp <= 0.2.2 Fixed in 0.2.3 Improper URL Scheme Validation third-party-advisory
https://github.com/cyberchitta/scrapling-fetch-mcp/issues/6 issue-tracking
https://github.com/cyberchitta/scrapling-fetch-mcp/commit/9f6f34e92c55c3d95566ad9c62aca7327d24533a patch
https://github.com/cyberchitta/scrapling-fetch-mcp/ product