The zevorn rt-claw project up to version 0.2.0 contains an SSRF vulnerability in the claw_net_get and claw_net_post functions of claw/services/tools/net.c. The vulnerability arises from improper handling of the URL argument, allowing an attacker to induce the server to make unintended HTTP requests. This can be exploited remotely without authentication. The issue was responsibly disclosed but remains unpatched as of the publication date. Public exploit details exist, increasing the risk of exploitation.

Successful exploitation allows an attacker to perform server-side request forgery, potentially enabling unauthorized internal network scanning, access to internal services, or other unintended interactions initiated by the vulnerable server. The vulnerability does not require user interaction or privileges, increasing its risk. However, no known active exploitation in the wild has been reported.

No official fix or patch is currently available, and the project has not responded to the vulnerability report. Users should monitor the project for updates and consider implementing network-level controls to restrict outbound requests from the affected component. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.