-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability combines two critical failures: 1) Unrestricted base URL modification allows SSRF (CWE-918), and 2) Sensitive API keys are included in requests to attacker-controlled endpoints (CWE-200). The first function likely handles user input for base URL without validation(), while the second function would be responsible for attaching sensitive headers to outbound requests. These would work in tandem to enable the described attack flow where authenticated users can exfiltrate credentials via modified endpoints.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @lobehub/chat | npm | < 0.162.25 | 0.162.25 |
A Semantic Attack on Google Gemini - Read the Latest Research