This vulnerability affects the fetch function in the AI Proxy Middleware of BigSweetPotatoStudio HyperChat up to version 2.0.0-alpha.63. By manipulating the baseurl parameter, an attacker can perform server-side request forgery, causing the server to make unintended HTTP requests. The vulnerability is remotely exploitable and publicly known. No official patch or remediation has been provided by the vendor as of the published date.

Successful exploitation allows an attacker to induce the vulnerable server to send crafted HTTP requests to arbitrary destinations. This can lead to unauthorized internal network scanning, data exfiltration, or interaction with internal services not normally accessible externally. The vulnerability does not require user interaction or privileges and has a medium severity rating (CVSS 6.9). No known active exploitation in the wild has been reported.

As of the published date, no official patch or remediation is available from the vendor. Users should monitor the vendor's communications for updates. Until a fix is provided, consider implementing network-level controls to restrict outbound requests from the affected service to trusted destinations only. Avoid exposing the vulnerable component to untrusted inputs or networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.