The vulnerability identified as CVE-2026-18973 affects heshengtao super-agent-party versions up to 0.4.1. It resides in the sanitize_proxy_url function of the server.py file in the extension_proxy Route component. The flaw allows an attacker to manipulate the url argument, leading to server-side request forgery (CWE-918). This can be exploited remotely without authentication. The vulnerability has a CVSS 3.1 base score of 7.3, indicating a moderate severity level with impacts on confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no official patch or mitigation has been published.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server, potentially accessing internal resources or services not directly reachable by the attacker. The CVSS score reflects a moderate impact on confidentiality, integrity, and availability. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level controls to restrict outbound requests from the affected component and monitor for suspicious activity related to proxy URL usage.