A vulnerability was found in 021is elvix-sdk up to 0.10.1. (CVE-2026-108542)

CVE-2026-108542 describes a server-side request forgery vulnerability in the 021is elvix-sdk software, specifically affecting an unknown functionality within the MCP Request Handler component located in src/mcp/index.ts. The vulnerability is triggered by manipulation of the 'path' argument, allowing an attacker to cause the server to make unintended requests. The vulnerability affects versions up to 0.10.1. The exploit code has been made public, but the vendor has not issued any response or patch. The CVSS v3.1 base score is 6.3, reflecting a medium severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this SSRF vulnerability could allow an attacker to induce the server to make arbitrary requests, potentially leading to information disclosure, integrity loss, or availability disruption. The attack can be performed remotely with low complexity and requires low privileges. The public availability of exploit code increases the risk of exploitation. However, no known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. In the meantime, consider implementing network-level controls to restrict outbound requests from the affected component and validate or sanitize inputs to the 'path' argument if possible.