PT-2026-64095

Server-Side Request Forgery SSRF in upload ad image via Unrestricted image url Fetch Summary The upload ad image MCP tool in meta-ads-mcp v1.0.113 passes an attacker-controlled image url parameter directly to an HTTP fetch helper httpx.AsyncClientfollow redirects=True.geturl without any scheme,...