This vulnerability in ItzCrazyKns Vane (up to version 1.12.1) allows an attacker to perform server-side request forgery by manipulating the baseURL parameter in the Model Provider API's route.ts file. This can cause the server to make unintended HTTP requests, potentially exposing internal resources or services. The issue was reported early to the project, but no official fix or remediation guidance has been provided. Exploitation is remote and an exploit is publicly available.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal or external systems. This could lead to information disclosure or interaction with internal services not normally accessible. However, the CVSS vector indicates low to low integrity and availability impact, and no privilege or user interaction is required. There is no indication of exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded or issued a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service or apply input validation and sanitization on the baseURL parameter if possible. Monitor vendor advisories for updates and apply patches promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.