The vulnerability in mf-yang openclaw-cn up to version 0.2.1 is a server-side request forgery (SSRF) found in the clickViaPlaywright function of src/browser/routes/agent.act.ts within the Browser Control HTTP API. This flaw enables remote attackers to manipulate the server into making unauthorized requests. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. Exploit details have been made public, but no known exploits are reported in the wild.

Successful exploitation of this SSRF vulnerability could allow an attacker to cause the server to send crafted requests to internal or external systems, potentially leading to unauthorized information disclosure or interaction with internal services. However, the impact is rated medium, indicating limited scope or complexity in exploitation and consequences.

No official fix or patch is currently available for this vulnerability. The vendor has not yet responded to the issue report. Users should monitor the vendor's advisories for updates and consider implementing network-level controls to restrict the server's outbound requests as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.