EUVD-2026-26294Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable SSRF with no auth required; scope unchanged as no subsequent system impact indicated; no meaningful availability impact from SSRF.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP Interface. Performing a manipulation of the argument media_paths results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the media_paths argument of the xhs_publish_content MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.
Technical ContextAI
xhs-mcp is a Model Context Protocol (MCP) server implementation by Algovate, designed to interface with the Xiaohongshu (XHS/Little Red Book) social media platform API. The vulnerability resides in the xhs_publish_content function within src/server/mcp.server.ts - the primary MCP interface layer. CWE-918 (Server-Side Request Forgery) identifies the root cause: the function accepts media_paths as input and constructs outbound HTTP requests without adequate URL validation or allowlisting, allowing an attacker to redirect the server's HTTP client to arbitrary internal or external targets. The CPE string cpe:2.3:a:algovate:xhs-mcp:*:*:*:*:*:*:*:* uses a wildcard version, suggesting other versions beyond 0.8.11 may also be affected, though only 0.8.11 is confirmed by EUVD-2026-26294.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor has not responded to the GitHub issue report (https://github.com/Algovate/xhs-mcp/issues/6). Organizations running xhs-mcp should immediately restrict network access to the MCP server so it is not reachable from untrusted networks; if the service must be externally accessible, deploy an egress proxy or firewall rule that allowlists only the specific Xiaohongshu API domains the tool legitimately needs to contact, blocking all other outbound destinations. Implementing input validation on media_paths to enforce a strict URL scheme and domain allowlist at the application layer is the most targeted compensating control, though it requires code modification. Monitor the GitHub repository at https://github.com/Algovate/xhs-mcp/ for a patched release and apply promptly when available.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today