CVE-2026-78061

Name of the Vulnerable Software and Affected Versions vas3k TaxHacker versions prior to 0.8.3

Description In the Email Sync component, the buildImapConfig() function within the lib/email-sync/imap-client.ts file is susceptible to server-side request forgery (SSRF), a flaw that allows an attacker to induce the server to make requests to an unintended location. This can be triggered remotely by manipulating the host and port arguments.

Recommendations As a temporary workaround, restrict the use of the buildImapConfig() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.