CVE-2026-18973

Name of the Vulnerable Software and Affected Versions heshengtao super-agent-party versions prior to 0.4.2

Description Remote attackers can trigger server-side request forgery (SSRF) by manipulating the url argument within the sanitize proxy url() function located in the server.py file of the extension proxy Route component. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations As a temporary workaround, restrict access to the sanitize proxy url() function in the extension proxy Route component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.