The vulnerability is a server‑side request forgery (SSRF) in horizon921 mcpilot 0.1.0. The file client/src/app/api/mcp/call/route.ts contains an unvalidated parameter, serverBaseUrl, that an attacker can manipulate. By sending a specially crafted request to the MCP API Call Endpoint, the server will issue outbound HTTP requests to arbitrary URLs chosen by the attacker. This can be used to exfiltrate data, access internal services, or pivot to other targets. The flaw is exploitable remotely and publicly available exploits have already been released. The issue remains unaddressed by the maintainers.

Horizon921 mcpilot version 0.1.0 is affected. No other versions are listed as vulnerable. The vulnerability resides in the MCP API Call Endpoint component located in client/src/app/api/mcp/call/route.ts.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not reported, so the probabilistic likelihood of exploitation cannot be quantified from the data. The vulnerability is not recorded in the CISA KEV catalog, suggesting it may not yet be widely exploited in the wild, but public exploit code is available. Attackers can launch the exploit remotely by targeting the API endpoint and manipulating the serverBaseUrl parameter. Given the remote nature and public availability of exploit code, the risk to systems running the vulnerable version is considerable and warrants prompt remediation.