This vulnerability in SmythOS sre (up to version 0.0.15) involves an information disclosure caused by improper handling of the baseURL argument in the Connector Service component's utils.ts file. An attacker can remotely manipulate this argument to disclose information. The vulnerability is publicly known and exploitable remotely without privileges, but requires user interaction. No official remediation or patch has been provided by the vendor as of the publication date.

The vulnerability allows remote attackers to cause information disclosure by manipulating the baseURL argument. This could lead to leakage of sensitive data handled by the affected component. The CVSS score of 5.1 reflects a medium impact, with low complexity and no required privileges but some user interaction needed. There is no indication of further impact such as code execution or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected component or implementing input validation controls to mitigate exploitation risk.