Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the component LLM Models API. Performing a manipulation of the argument req.query.base_url results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-7147 Server-Side Request Forgery in JoeCastrom mcp-chat-studio LLM Models API 1.5.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7147
Post summary
The text announces CVE‑2026‑7147 as a Server‑Side Request Forgery vulnerability in JoeCastrom mcp‑chat‑studio LLM Models API 1.5.0, but provides no exploitation details, PoC, or patch information.
CVE-2026-7147 A vulnerability was detected in JoeCastrom mcp-chat-studio up to 1.5.0. Affected by this issue is some unknown functionality of the file server/routes/llm.js of the com… https://www.cve.org/CVERecord?id=CVE-2026-7147
Post summary
A new CVE (CVE‑2026‑7147) has been disclosed for JoeCastrom mcp‑chat‑studio, affecting the file server/routes/llm.js, with no PoC, exploit script, or patch information provided.