CVE-2026-6616: TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery
A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extractwithbs4/extractwith3k/extractwithlxml of the file superagi/helper/webpageextractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6616?
CVE-2026-6616 is categorized as a high severity vulnerability due to its potential for server-side request forgery.
How do I fix CVE-2026-6616?
To fix CVE-2026-6616, upgrade the TransformerOptimus SuperAGI WebScraperTool to version 0.0.15 or later.
What components are affected by CVE-2026-6616?
CVE-2026-6616 affects the extract_with_bs4, extract_with_3k, and extract_with_lxml functions in the TransformerOptimus SuperAGI WebScraperTool.
What is the impact of CVE-2026-6616?
The impact of CVE-2026-6616 includes the potential for an attacker to execute unauthorized requests from the server.
Is my software vulnerable if I am using TransformerOptimus SuperAGI WebScraperTool version 0.0.14?
Yes, using TransformerOptimus SuperAGI WebScraperTool version 0.0.14 makes your software vulnerable to CVE-2026-6616.