PT-2025-23141 · Unknown · Mcp-Markdownify-Server

Raul Onitza-Klugman · Published 2025-05-29 · Updated 2025-09-08 · CVE-2025-5273

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions mcp-markdownify-server versions all

Description The issue allows an attacker to craft a prompt that, once accessed by the MCP host, will enable it to read arbitrary files from the host running the server via the get-markdown-file tool.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-5273

GHSA-22V8-P7H2-RJ7P

Affected Products

Mcp-Markdownify-Server

References · 15

• 🔥 https://security.snyk.io/vuln/SNYK-JS-MCPMARKDOWNIFYSERVER-10249193 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5273 · Security Note
• https://osv.dev/vulnerability/GHSA-22v8-p7h2-rj7p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-5273 · Vendor Advisory
• https://github.com/zcaceres/markdownify-mcp · Note
• https://github.com/zcaceres/markdownify-mcp/blob/3667bd4765c0e49684ce22df268d02dd478a7f3b/src/Markdownify.ts#L94 · Note
• https://github.com/zcaceres/markdownify-mcp/commit/3a6b202d088ef7acb8be84bc09515f41a2b1a9df · Note
• https://github.com/zcaceres/markdownify-mcp/blob/3667bd4765c0e49684ce22df268d02dd478a7f3b/src/Markdownify.ts%23L94 · Note
• https://twitter.com/dukeoxdegen/status/1964868181614551421 · Twitter Post
• https://t.me/cvetracker/24879 · Telegram Post
• https://t.me/latest_high_impact_cve/2484 · Telegram Post
• https://twitter.com/CVEnew/status/1927957276083605876 · Twitter Post
• https://t.me/cvenotify/123944 · Telegram Post
• https://twitter.com/cybercronai/status/1928437116628808102 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1927962666770858201 · Twitter Post