A server-side request forgery vulnerability was discovered in Algovate xhs-mcp version 0.8.11. The vulnerability affects the xhs_publish_content function in the MCP Interface component, specifically through manipulation of the media_paths argument. The attack can be initiated remotely and an exploit has been made publicly available. The project maintainers were notified early through an issue report but have not yet responded to address the vulnerability.