EUVD-2026-25906Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, no auth, no complexity, but impact is partial and scope unchanged per CVSS 4.0 SC:N/SI:N/SA:N baseline.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in JoeCastrom mcp-chat-studio (all versions through 1.5.0) allows unauthenticated remote attackers to forge arbitrary server-initiated HTTP requests by injecting a malicious URL into the base_url query parameter of the LLM Models API (server/routes/llm.js). A public exploit exists via GitHub issue report, and SSVC classifies this as automatable - meaning it can be scripted for broad scanning. No patch has been issued; the maintainer has not responded to the coordinated disclosure.
Technical ContextAI
The vulnerable component is server/routes/llm.js, the backend routing layer responsible for proxying requests to LLM provider APIs. The application accepts a user-supplied base_url query parameter and uses it directly as the target for server-side HTTP requests without URL validation, allowlisting, or sanitization - a textbook CWE-918 (Server-Side Request Forgery) pattern. This design allows the server to be weaponized as an HTTP proxy, directing outbound requests to arbitrary destinations including RFC1918 addresses, cloud metadata endpoints (e.g., 169.254.169.254), or internal microservices. The affected product is an MCP (Model Context Protocol) chat interface, CPE: cpe:2.3:a:joecastrom:mcp-chat-studio:*:*:*:*:*:*:*:*, covering all releases from 1.0 through 1.5.0.
RemediationAI
No vendor-released patch identified at time of analysis - the maintainer has not responded to the disclosure. Organizations running mcp-chat-studio should apply the following compensating controls in priority order: First, block outbound HTTP requests from the application server to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, fd00:ec2::254) via host or network firewall - this prevents the most severe SSRF pivot scenarios but does not eliminate the vulnerability. Second, deploy a WAF or reverse proxy rule that validates the base_url parameter against an explicit allowlist of permitted LLM provider domains (e.g., api.openai.com, api.anthropic.com) and rejects all others - note this may break functionality if additional LLM providers are in use. Third, if the LLM Models API endpoint is not required, disable or restrict access to the route entirely. Monitor https://github.com/JoeCastrom/mcp-chat-studio/issues/4 and the project repository (https://github.com/JoeCastrom/mcp-chat-studio/) for patch availability.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today