The GoClaw product from nextlevelbuilder version 3.13.3-beta.3 contains a server-side request forgery vulnerability in the bytePlusDownloadVideo function of internal/tools/create_video_byteplus.go. This vulnerability arises from improper validation or sanitization of the output.video_url argument, enabling an attacker to coerce the server into making arbitrary HTTP requests. The vulnerability is remotely exploitable and has been publicly disclosed. No official patch or remediation level has been provided by the vendor at this time.

Successful exploitation of this SSRF vulnerability allows an attacker to induce the server to send crafted HTTP requests to internal or external systems. This can lead to information disclosure or interaction with internal services that are otherwise inaccessible. The CVSS score of 5.3 indicates a medium impact, with low complexity and no user interaction required. However, the vulnerability does not escalate privileges or directly cause denial of service based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting or validating input to the output.video_url parameter to prevent SSRF exploitation.