CVE-2026-94040: vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery
A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability can be exploited remotely. The available information does not state whether authentication or access to the settings functionality is required.
Which component is affected?
The affected function is testLLMProviderAction in app/(app)/apps/settings/actions.ts. Manipulated provider, apiKey, model, or baseUrl arguments can trigger the server-side request forgery condition.
Is there a public exploit?
Yes. An exploit has been published and may be used.
Which versions should be treated as affected?
vas3k TaxHacker versions up to and including 0.8.5 are reported as affected. No fixed version is provided in the available information.
What should teams do if no patch is available?
The available information does not provide a vendor mitigation or workaround. Review and restrict exposure of the affected settings action and its ability to make outbound requests until an official response or fix is available.