CVE-2026-108542: Server-Side Request Forgery in 021is elvix-sdk

This vulnerability in 021is elvix-sdk up to version 0.10.1 involves server-side request forgery due to improper handling of the 'path' argument in the MCP Request Handler component (src/mcp/index.ts). An attacker can remotely exploit this flaw to induce the server to make unintended requests. The vendor was notified but did not respond, and no official fix or patch has been released. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation allows remote attackers to induce the server to make arbitrary requests, potentially accessing internal resources or services not directly accessible to the attacker. The impact is limited by the medium severity score and the low complexity of the attack. No known active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is released, users should consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests or apply other SSRF mitigations relevant to their environment.