CVE-2026-9372

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-9372

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9372.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-9372

Published

2026-05-24T10:00:18.239Z

Modified

2026-07-08T08:12:01.319448021Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

ItzCrazyKns Vane Model Provider API route.ts server-side request forgery

Details

A flaw has been found in ItzCrazyKns Vane up to 1.12.1. This vulnerability affects unknown code of the file src/app/api/providers/route.ts of the component Model Provider API. This manipulation of the argument baseURL causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9372.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-918"
    ]
}

References

Affected packages

Git / github.com/itzcrazykns/vane

Affected ranges

Type

GIT

Repo

https://github.com/itzcrazykns/vane

Events

Introduced

b450d0e668e436df3d706545c24990ba486fe108

Last affected

3b8d8be6761949cf9034d6b3d9ec82a78115cb81

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "1.12.0"
        },
        {
            "last_affected": "1.12.0"
        },
        {
            "introduced": "1.12.1"
        },
        {
            "last_affected": "1.12.1"
        }
    ]
}

Affected versions

1.*

1.12.0

1.12.1

v1.*

v1.12.0

v1.12.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9372.json"