CVE-2026-108787: Server-Side Request Forgery in houtini-ai voice-analyser-mcp

The vulnerability CVE-2026-108787 affects houtini-ai voice-analyser-mcp up to and including version 2.1.1. It is a server-side request forgery (SSRF) issue in the fetch function of src/utils/crawler.ts in the collect_corpus component. By manipulating the sitemap_url parameter, an attacker can cause the server to send unauthorized requests to internal or external systems. This vulnerability is remotely exploitable without user interaction and requires low privileges. The vendor has not issued a patch or advisory, and the exploit has been publicly disclosed, increasing the risk of potential attacks.

Successful exploitation allows an attacker to make the vulnerable server perform arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further network reconnaissance. The CVSS 4.0 base score is 5.3 (medium), reflecting the moderate impact and ease of exploitation with low privileges and no user interaction required.

No official fix or patch is currently available from the vendor. Users should monitor vendor channels for updates. Until a patch is released, consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, such as firewall rules or proxy filtering. Validate and sanitize inputs to the sitemap_url parameter if possible to reduce risk.