| शीर्षक | BigSweetPotatoStudio HyperChat 2.0.0-alpha.63 Server-Side Request Forgery |
|---|
| विवरण | A server-side request forgery (SSRF) vulnerability (CWE-918) has been identified in the AI proxy middleware of HyperChat, specifically within packages/core/src/http/aiProxyMiddleware.mts. The HTTP middleware accepts an attacker-controlled baseurl request header, appends the remaining request path, and forwards the request using fetch() without validation or allowlisting. An attacker with network access to the HyperChat HTTP service can coerce the server into making arbitrary outbound HTTP requests to attacker‑controlled or internal destinations. Version 2.0.0-alpha.63 is confirmed affected, and no fixed version is available at the time of reporting. |
|---|
| स्रोत | ⚠️ https://github.com/BigSweetPotatoStudio/HyperChat/issues/142 |
|---|
| उपयोगकर्ता | BruceJin (UID 96538) |
|---|
| सबमिशन | 10/04/2026 06:34 PM (2 महीनों पहले) |
|---|
| संयम | 27/04/2026 05:38 PM (17 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359823 [BigSweetPotatoStudio HyperChat तक 2.0.0-alpha.63 AI Proxy Middleware aiProxyMiddleware.mts fetch baseurl अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|