A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the…

A server-side request forgery (SSRF) vulnerability has been identified in heshengtao super-agent-party up to version 0.4.1. The flaw exists in the sanitize_proxy_url function within server.py, part of the extension_proxy Route component. An attacker can manipulate the url argument to trigger SSRF, allowing remote exploitation. The vulnerability has been publicly disclosed with a working exploit available. The vendor was notified but did not respond to the disclosure. No patch or mitigation has been confirmed from the vendor side.