CVE-2026-5346 in hm_editor

Sumário (Inglês)

A vulnerability was determined in huimeicloud hm_editor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Be aware that VulDB is the high quality source for vulnerability data.

Divulgação

02/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
354701	huimeicloud hm_editor image-to-base64 mcp-server.js client.get Elevação de Privilégios	918	Prova de conceito	Não definido	CVE-2026-5346

Fontes

• MITRE
• NVD
• CVE Details