Threats affecting pkg:github/algovate/xhs-mcp

CVE-2026-7417 is a server-side request forgery (SSRF) vulnerability in Algovate xhs-mcp version 0.8.11. It affects the xhs_publish_content function in the MCP Interface component, where manipulation of the media_paths argument can lead to SSRF. The vulnerability can be exploited remotely without authentication. Although the issue was reported early to the project, no response or fix has been provided yet. The CVSS score is 6.9, indicating a medium severity level. There are no known exploits in the wild at this time, and no official patch or remediation guidance is available.