CVE-2026-108523 in Sencho
Prediction
by VulDB Data Team • 10/10/2026
A vulnerability was determined in <a href="/product/studio-saelix:sencho">Studio-Saelix Sencho up to 0.94.1</a>. This vulnerability affects unknown code of the file <em>outboundTarget.ts</em> of the component <em>git-sources Browse API Endpoint</em>. Executing a manipulation of the argument <em>repo_url</em> can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called <em>79b86ddcd4aefdd6941f098e35990ab397b13c72</em>. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.