CVE-2026-102923

MediumCVSS 5.4

Published: 16/10/2026(UTC)Updated: 16/10/2026(UTC)Translated: 16/10/2026(UTC)NVD NIST

Summary

In SparkyFitness prior to 1.6.0, chatService.ts and labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user can save a custom AI service URL and invoke an affected AI flow, triggering an outbound request with a controlled bearer value.

Risk Assessment

Successful exploitation allows sending server-side POST requests, probing internal services, and disclosing the AI system prompt, potentially leading to information leakage and server-side request forgery.

Recommendation

Update SparkyFitness to version 1.6.0 or later, which fixes this vulnerability.

Other vulnerabilities in SparkyFitness

CVE-2026-92263High
In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.

Original NVD description (English source)

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS