The vulnerability in zevorn rt-claw up to version 0.2.0 is due to improper validation or sanitization of the URL argument in the claw_net_get and claw_net_post functions of claw/services/tools/net.c. This flaw enables an attacker to perform server-side request forgery (SSRF), causing the server to send crafted requests to arbitrary destinations. The vulnerability is remotely exploitable without requiring privileges or user interaction. The exploit details have been publicly disclosed, but the vendor has not issued a patch or official remediation as of the publication date.

Successful exploitation of this SSRF vulnerability can allow an attacker to make the vulnerable server perform unauthorized requests to internal or external systems. This may lead to information disclosure, interaction with internal services, or other indirect impacts depending on the server environment. The CVSS score of 6.9 reflects a medium severity impact with low complexity and no required privileges or user interaction.

No official fix or patch is currently available from the vendor. Since the project has not responded or issued a remediation, users should consider implementing network-level restrictions to limit outbound requests from the affected component or isolate the vulnerable service until a patch is released. Monitor vendor advisories for updates regarding an official fix. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.