The vulnerability exists in the sanitize_proxy_url function of the server.py file in the extension_proxy Route component of heshengtao super-agent-party up to version 0.4.1. Manipulation of the url argument allows an attacker to perform server-side request forgery, potentially causing the server to make unintended requests. The flaw can be exploited remotely without any privileges or user interaction. The vendor was contacted but did not respond, and no patch or official remediation has been published. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

Successful exploitation of this SSRF vulnerability could allow an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise accessible. The impact is rated medium based on the CVSS score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service or apply other SSRF mitigations until an official patch is available.