CVE-2026-15624

Name of the Vulnerable Software and Affected Versions nextlevelbuilder GoClaw version 3.13.3-beta.3

Description An issue exists in the invoke endpoint within the bytePlusDownloadVideo() function of the internal/tools/create video byteplus.go file. Manipulation of the output.video url variable allows for server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. This flaw can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the invoke endpoint or avoid using the output.video url parameter.