CVE-2026-15750 describes a server-side request forgery vulnerability in the mastergo-magic-mcp product by mastergo-design, affecting versions 0.1 and 0.2.0. The vulnerability resides in the z.string function of the src/tools/get-component-link.ts file, specifically in the mcp__getComponentLink component. By manipulating the url argument, an attacker can cause the server to make unintended requests. The vulnerability is remotely exploitable, and a public proof-of-concept exploit is available. The vendor has been notified but has not yet provided a remediation or patch.

Successful exploitation allows an attacker to induce the server to make arbitrary requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further attacks depending on the internal network configuration. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should avoid exposing the vulnerable component to untrusted inputs or networks. Implement input validation or filtering on the url argument as a temporary measure until an official fix is available.