This vulnerability in mf-yang openclaw-cn up to version 0.2.1 involves the clickViaPlaywright function in src/browser/routes/agent.act.ts, which is part of the Browser Control HTTP API. An attacker can remotely manipulate this function to perform server-side request forgery (SSRF), causing the server to initiate unintended requests. The issue was reported early to the project but remains unaddressed, and no official patch or remediation is currently available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impacts on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or interaction with internal systems. The overall impact is rated medium based on the CVSS score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should consider restricting access to the vulnerable API or implementing network-level controls to limit server outbound requests until an official fix is available.