Threats tagged 'ghsa-4jg5-6fpg-j2hg'

CVE-2026-7417 is a server-side request forgery (SSRF) vulnerability in Algovate xhs-mcp version 0.8.11. It affects the xhs_publish_content function in the MCP Interface component, specifically in the src/server/mcp.server.ts file. The vulnerability arises from manipulation of the media_paths argument, allowing remote attackers to initiate SSRF attacks. Public exploit code exists, and the project has not yet responded with a fix.