Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-6w53-8mcc-fqqh

Опубликовано: 01 июн. 2026
Источник: github
Github: Не прошло ревью
CVSS4: 5.5
CVSS3: 7.3

Описание

A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

EPSS

Процентиль: 23%
0.00305
Низкий

5.5 Medium

CVSS4

7.3 High

CVSS3

Дефекты

CWE-918

Связанные уязвимости

CVSS3: 7.3
nvd
3 месяца назад

A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

EPSS

Процентиль: 23%
0.00305
Низкий

5.5 Medium

CVSS4

7.3 High

CVSS3

Дефекты

CWE-918