EUVD-2026-53694
GHSA-m39w-xf3h-v4h2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication per 4.0 vector; SSRF provides read access to internal resources (C:L) without direct write or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Server-side request forgery in heshengtao's super-agent-party (versions 0.4.0-0.4.1) enables remote unauthenticated attackers to coerce the application into issuing arbitrary HTTP requests to internal or otherwise restricted network destinations. The flaw exists in the sanitize_proxy_url function within server.py on the extension_proxy route, where the url argument is insufficiently validated before being acted upon. A public proof-of-concept exploit is available via GitHub Gist, lowering the barrier to exploitation; the vendor did not respond to responsible disclosure, and no patch has been released.
Technical ContextAI
super-agent-party is a Python-based AI agent framework by heshengtao. The affected component is an extension proxy route that accepts a url parameter and passes it through the sanitize_proxy_url function in server.py before making an outbound HTTP request on behalf of the caller. CWE-918 (Server-Side Request Forgery) describes the root cause: insufficient validation of user-supplied URLs allows the server to be directed toward internal network resources, cloud metadata services (e.g., 169.254.169.254), or other restricted endpoints. The CPE cpe:2.3:a:heshengtao:super-agent-party:*:*:*:*:*:*:*:* covers all versions through 0.4.1 as confirmed by EUVD-2026-53694. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms remote, unauthenticated access with no special attack prerequisites.
RemediationAI
No vendor-released patch identified at time of analysis - the vendor was unresponsive to responsible disclosure, and no fixed version has been confirmed from available data. As compensating controls, operators should restrict the super-agent-party server's egress network access to block requests to RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.0.0/16), and loopback (127.0.0.0/8) at the host or network firewall level - this prevents the most dangerous internal pivot and metadata-endpoint abuse scenarios, though it does not eliminate the SSRF class entirely. If the extension_proxy route is not required for production use, disabling or access-controlling it via reverse proxy or application configuration removes the attack surface directly. Implementing a strict URL allowlist within the proxy function (permitting only known-good external domains) is the most surgical application-layer fix pending an upstream patch. Monitor outbound HTTP request logs from the application for anomalous internal-IP destinations as a detection measure.
More in Super Agent Party
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today