CVE-2026-18973

HighCVSS 7.3

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

A vulnerability was found in heshengtao super-agent-party up to 0.4.1, affecting the function sanitize_proxy_url in the file server.py in the extension_proxy Route component. Manipulation of the url argument leads to server-side request forgery. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Risk Assessment

An attacker can exploit SSRF to send requests to internal network resources, potentially leading to data disclosure or attacks on other systems.

Recommendation

Update super-agent-party to the latest patched version. Restrict access to the sanitize_proxy_url function and validate URLs before use.

Other vulnerabilities in super-agent-party

CVE-2026-18974Medium
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. It affects the function get_file_content in the file server.py of the execute_tool_manually Endpoint. Manipulation of the tool_name/tool_params arguments results in information disclosure. The attack can be launched remotely, and the exploit has been made public.

Original NVD description (English source)

A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitize_proxy_url of the file server.py of the component extension_proxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.