CVE-2026-108850: Server-Side Request Forgery (SSRF) in guy-hartstein company-research-agent

CVE-2026-108850 is a server-side request forgery vulnerability in the Company Research Agent product by guy-hartstein, affecting versions up to and including 2.2.0. The vulnerability arises from improper sanitization of ReportLab paragraph markup in the /generate-pdf endpoint, allowing unauthenticated attackers to embed inline img elements in the report_content parameter. This causes the server to fetch resources from arbitrary internal or external hosts, potentially leaking image data in the returned PDF and enabling network reconnaissance. There is no indication of active exploitation in the wild or known patches at this time.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary outbound HTTP requests. This can lead to information disclosure through leaked image responses embedded in generated PDFs and can be used to probe internal network reachability. The vulnerability does not require user interaction or privileges, increasing its risk. However, no direct remote code execution or data modification impact is described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /generate-pdf endpoint if possible and monitor for unusual outbound requests from the server. Avoid processing untrusted input in report_content that includes markup capable of triggering outbound requests.