CVE-2026-6616

MEDIUM

TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

Title source: cna

Description

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract_with_bs4/extract_with_3k/extract_with_lxml of the file superagi/helper/webpage_extractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358251 | TransformerOptimus SuperAGI WebScraperTool webpage_extractor.py extract_with_lxml server-side request forgery

https://vuldb.com/vuln/358251

Signature, Permissions Required signature permissions-required

VDB-358251 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/358251/cti

Third Party Advisory third-party-advisory

Submit #791084 | SuperAGI up to c3c1982 Server-Side Request Forgery (CWE-918)

https://vuldb.com/submit/791084

Exploit exploit

https://gist.github.com/YLChen-007/4bb1d709cbb58cee46d839c651d3221f

Scores

CVSS v3 6.3

EPSS 0.0022

EPSS Percentile 12.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (14)

TransformerOptimus/SuperAGI 0.0.1

TransformerOptimus/SuperAGI 0.0.10

TransformerOptimus/SuperAGI 0.0.11

TransformerOptimus/SuperAGI 0.0.12

TransformerOptimus/SuperAGI 0.0.13

TransformerOptimus/SuperAGI 0.0.14

TransformerOptimus/SuperAGI 0.0.2

TransformerOptimus/SuperAGI 0.0.3

TransformerOptimus/SuperAGI 0.0.4

TransformerOptimus/SuperAGI 0.0.5

... and 4 more

Published Apr 20, 2026

Tracked Since Apr 20, 2026