Company Research Agent
Monthly
Server-side request forgery in Company Research Agent through 2.2.0 allows unauthenticated remote attackers to make the server issue outbound HTTP requests by injecting unescaped ReportLab paragraph markup - specifically inline img elements - into the report_content parameter handled by the /generate-pdf endpoint, with the fetched image responses embedded in the returned PDF to give an attacker a content-leakage and internal-reachability oracle. Impact is confined to confidentiality (only responses renderable as images leak content), with no integrity or availability effect, and no public exploit code has been identified at time of analysis, although a public technical writeup describes the injection technique. The issue is tracked as CWE-918 and rated CVSS 4.0 base 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L), consistent with an independent assessment of a genuine-but-moderate SSRF.
Server-side request forgery in Company Research Agent through 2.2.0 allows unauthenticated remote attackers to make the server issue outbound HTTP requests by injecting unescaped ReportLab paragraph markup - specifically inline img elements - into the report_content parameter handled by the /generate-pdf endpoint, with the fetched image responses embedded in the returned PDF to give an attacker a content-leakage and internal-reachability oracle. Impact is confined to confidentiality (only responses renderable as images leak content), with no integrity or availability effect, and no public exploit code has been identified at time of analysis, although a public technical writeup describes the injection technique. The issue is tracked as CWE-918 and rated CVSS 4.0 base 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L), consistent with an independent assessment of a genuine-but-moderate SSRF.