This vulnerability exists in the extract_with_bs4, extract_with_3k, and extract_with_lxml functions within the superagi/helper/webpage_extractor.py file of the WebScraperTool component in TransformerOptimus SuperAGI up to version 0.0.14. It allows an attacker to perform server-side request forgery remotely by manipulating these functions. The vendor was notified but has not issued any patch or remediation guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to induce the server to make arbitrary HTTP requests, potentially accessing internal resources or services not directly reachable by the attacker. The impact is rated medium with limited confidentiality, integrity, and availability impact according to the CVSS 4.0 score of 5.3. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider applying workarounds such as disabling or restricting the vulnerable WebScraperTool functions if possible, or isolating the affected component to limit SSRF risks until an official fix is released.