Description
A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.0.0-alpha.63
References
Could your website be exposed too?
SmartScanner can check your website for BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints - CVE-2026-53513
- LangSmith Client SDK Affected by Server-Side Request Forgery via Tracing Header Injection - CVE-2026-25528
- pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801
- React Router has CSRF issue in Action/Server Action Request Processing - CVE-2026-22030
You might also like:
See something that needs correcting? Let us knowUpdated May 06, 2026