CVE-2026-9372

HighCVSS 7.3

Published: 24/05/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

20th percentile - higher than 20% of all known CVEs

Summary

ItzCrazyKns Vane up to version 1.12.1 is vulnerable to server-side request forgery (SSRF) in the file src/app/api/providers/route.ts of the Model Provider API component. Manipulation of the baseURL argument allows remote exploitation.

Risk Assessment

An attacker can use the server to send requests to internal network resources, potentially leading to disclosure of sensitive data or further attacks on the infrastructure.

Recommendation

Immediately update Vane to a patched version. If unavailable, restrict API access and validate the baseURL argument.

Other vulnerabilities in Vane

CVE-2026-9371Medium
A missing authentication vulnerability was found in the API component of Vane up to version 1.12.1, specifically in the route.ts file. The attack can be performed remotely but is considered difficult. The exploit has been publicly disclosed.

Original NVD description (English source)

A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Model Provider API. This manipulation of the argument baseURL causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.