CVE-2026-19373 PUBLISHED

PhialsBasement KoboldCPP-MCP-Server BaseConfigSchema index.ts makeRequest server-side request forgery

Assigner: VulDB
Reserved: 09.08.2026 Published: 09.08.2026 Updated: 09.08.2026

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to launch the attack on the local host. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 4.8

Product Status

Vendor PhialsBasement
Product KoboldCPP-MCP-Server
Versions
  • Version 1.0.0 is affected

Credits

  • gongyanyu05 (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Server-Side Request Forgery CWE