CVE-2026-108787: houtini-ai voice-analyser-mcp collect_corpus crawler.ts fetch server-side request forgery
A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/crawler.ts of the component collectcorpus. Performing a manipulation of the argument sitemapurl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
houtini-ai voice-analyser-mcp versions up to and including 2.1.1 are affected. The vulnerable code is the collect_corpus component's fetch function in src/utils/crawler.ts.
What does an attacker need to exploit this issue?
An attacker needs the ability to manipulate the sitemap_url argument provided to collect_corpus. Exploitation can be performed remotely, requires low privileges, and does not require user interaction.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
How can I determine whether my deployment may be vulnerable?
Check whether the installed houtini-ai voice-analyser-mcp version is 2.1.1 or earlier and whether collect_corpus accepts or processes attacker-influenced sitemap_url values. The provided information does not identify a fixed version or an available vendor patch.