This vulnerability affects the fetch function in the AI Proxy Middleware component of BigSweetPotatoStudio HyperChat up to version 2.0.0-alpha.63. By manipulating the baseurl parameter, an attacker can perform server-side request forgery, causing the server to make unintended HTTP requests. The vulnerability is remotely exploitable without authentication and has a publicly available exploit. No official patch or remediation has been provided by the vendor as of the published date.

Successful exploitation allows an attacker to induce the vulnerable server to send crafted HTTP requests to arbitrary destinations. This can potentially be used to access internal resources or services not directly accessible to the attacker. The vulnerability does not require user interaction or privileges, increasing its risk. However, the overall severity is medium based on the CVSS score of 6.9.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service and monitor for suspicious activity related to SSRF attempts. Avoid exposing the vulnerable component to untrusted networks until a fix is available.