A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of…

A server-side request forgery (SSRF) vulnerability has been discovered in horizon921 mcpilot version 0.1.0. The flaw exists in an unknown function of the file client/src/app/api/mcp/call/route.ts within the MCP API Call Endpoint component. The vulnerability can be exploited remotely by manipulating the serverBaseUrl argument. A public exploit has been released and may be used for attacks. The project maintainers have been notified through an issue report but have not yet responded to the vulnerability disclosure.