Elvix Sdk
Monthly
Server-side request forgery (SSRF) in elvix-sdk versions up to 0.10.1 allows remote attackers with low-privileged authenticated access to the MCP Request Handler to manipulate the 'path' argument in src/mcp/index.ts, causing the server to make arbitrary outbound requests. Publicly available exploit code exists, though no confirmed active exploitation has been observed. The vendor was contacted but did not respond, and no patch is available, leaving mitigation to compensating controls.
Server-side request forgery (SSRF) in elvix-sdk versions up to 0.10.1 allows remote attackers with low-privileged authenticated access to the MCP Request Handler to manipulate the 'path' argument in src/mcp/index.ts, causing the server to make arbitrary outbound requests. Publicly available exploit code exists, though no confirmed active exploitation has been observed. The vendor was contacted but did not respond, and no patch is available, leaving mitigation to compensating controls.