A vulnerability was found in Algovate xhs-mcp 0.8.11. This affects the function xhs_publish_content of the file src/server/mcp.server.ts of the component MCP In…

A server-side request forgery vulnerability was discovered in Algovate xhs-mcp version 0.8.11. The vulnerability affects the xhs_publish_content function in the MCP Interface component, specifically through manipulation of the media_paths argument. The attack can be initiated remotely and an exploit has been made publicly available. The project maintainers were notified early through an issue report but have not yet responded to address the vulnerability.