The vulnerability in aerostackdev aerostack-mcp up to commit 6315dfde7df0a15aaf743f88d91347115e09ba23 involves the upload_media function of the mcp-whatsapp component. Manipulating the media_url parameter leads to server-side request forgery, enabling remote attackers to cause the server to make arbitrary HTTP requests. Due to the rolling release nature of the project, no explicit version ranges are identified as affected or fixed. No vendor advisory or patch information is available, and the vendor has not responded to the issue report.

Successful exploitation allows remote attackers to induce the server to perform arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further network-based attacks depending on the server's network environment. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a fix is available, consider restricting or validating inputs to the upload_media function to prevent malicious media_url values if feasible.