Xhs Mcp
Monthly
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the `media_paths` argument of the `xhs_publish_content` MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.
Server-side request forgery in Algovate xhs-mcp 0.8.11 allows remote unauthenticated attackers to manipulate the `media_paths` argument of the `xhs_publish_content` MCP function, causing the server to issue arbitrary HTTP requests on behalf of the attacker. A public proof-of-concept exploit exists (GitHub issue tracker), and SSVC classifies this as automatable with partial technical impact. No vendor patch has been released and the vendor has not responded to the responsible disclosure report, leaving deployments without an official fix.