CVE-2026-7147

Name of the Vulnerable Software and Affected Versions JoeCastrom mcp-chat-studio versions prior to 1.5.1

Description An issue exists in the LLM Models API component within the file 'server/routes/llm.js'. Manipulation of the req.query.base url argument allows for server-side request forgery, which is a flaw that enables an attacker to induce the server-side application to make requests to an unintended location. This can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.