CVE-2026-7223

HIGH

BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery

Title source: cna

Description

A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

[Vdb Entry, Technical Description] https://vuldb.com/vuln/359823

[Signature, Permissions Required] https://vuldb.com/vuln/359823/cti

[Third Party Advisory] https://vuldb.com/submit/802265

[Exploit] https://github.com/BigSweetPotatoStudio/HyperChat/issues/142

[Product] https://github.com/BigSweetPotatoStudio/HyperChat/

Scores

CVSS v3 7.3

EPSS 0.0004

EPSS Percentile 12.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (50)

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.0

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.1

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.10

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.11

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.12

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.13

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.14

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.15

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.16

BigSweetPotatoStudio/HyperChat 2.0.0-alpha.17

... and 40 more

Published Apr 28, 2026

Tracked Since Apr 28, 2026