CVE-2026-18973: heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18973?
CVE-2026-18973 has a high severity rating of 7.3.
How does CVE-2026-18973 affect the heshengtao super-agent-party?
CVE-2026-18973 allows for server-side request forgery through the sanitize_proxy_url function in server.py.
What component is vulnerable in CVE-2026-18973?
The vulnerable component in CVE-2026-18973 is the extension_proxy Route of heshengtao super-agent-party.
How can I mitigate CVE-2026-18973?
To mitigate CVE-2026-18973, upgrade to a fixed version of heshengtao super-agent-party that is above 0.4.1.
What type of attack does CVE-2026-18973 facilitate?
CVE-2026-18973 facilitates server-side request forgery (SSRF) attacks.