CVE-2026-108523: Server-Side Request Forgery in Studio-Saelix Sencho

Studio-Saelix Sencho versions 0.94.0 and 0.94.1 contain a server-side request forgery vulnerability in the git-sources Browse API Endpoint (outboundTarget.ts). An attacker can manipulate the repo_url parameter to cause the server to make unauthorized requests. The vendor states that repository access is a privileged function and no privilege escalation or unprivileged access is demonstrated. To mitigate, the vendor has hardened repository access by validating and pinning DNS resolution, rejecting loopback, link-local, multicast, special-use, and metadata targets, disabling redirects and inherited proxy routing, and enforcing strict SSH host-key verification. A patch (commit 79b86ddcd4aefdd6941f098e35990ab397b13c72) is available to fix the vulnerability.

The vulnerability allows an attacker with at least privileged access to manipulate the repo_url argument to perform server-side request forgery. This could potentially allow the server to make unauthorized network requests. However, the vendor disputes that this leads to privilege boundary bypass or unprivileged access. The impact is therefore limited to scenarios where an attacker already has some level of privilege. The CVSS 4.0 score of 5.3 reflects a medium severity impact with network attack vector, low complexity, and limited confidentiality impact.

A patch is available identified by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72 and should be applied to affected versions 0.94.0 and 0.94.1. The vendor has also implemented defense-in-depth measures including DNS resolution pinning, rejection of certain network targets, disabling redirects and proxy routing, and strict SSH host-key verification. Users should apply the patch and follow vendor guidance to ensure these mitigations are in place.