CVE-2026-108523: Studio-Saelix Sencho git-sources Browse API Endpoint outboundTarget.ts server-side request forgery
A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repourl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Studio-Saelix Senchoto a version that resolves this vulnerability.Patch 79b86ddcd4aefdd6941f098e35990ab397b13c72
Event History
Frequently Asked Questions
Who can invoke the affected repository-access functionality?
The severity vector indicates that low privileges are required and no user interaction is needed. However, the vendor describes repository access as an intentional privileged administrative function and disputes that unprivileged users can use it to cross a privilege boundary.
What input is involved in exploitation?
Exploitation involves manipulating the repo_url argument used by the git-sources Browse API endpoint. The attack can be performed remotely, and a public exploit disclosure exists.
What should be done if this deployment uses repository URLs on internal networks?
Apply patch 79b86ddcd4aefdd6941f098e35990ab397b13c72. The vendor states that the hardening adds DNS validation and pinning, rejects loopback, link-local, multicast, selected special-use and metadata targets, and disables redirects and inherited proxy routing.
Are all installations through version 0.94.1 confirmed vulnerable?
No. The issue is reported to affect Sencho up to 0.94.1, but the available information explicitly says that the vulnerability's presence remains uncertain.