This vulnerability in ItzCrazyKns Vane (up to version 1.12.1) allows an attacker to perform server-side request forgery by manipulating the baseURL parameter in the Model Provider API's route.ts file. This can cause the server to make unintended requests, potentially exposing internal resources or services. The issue is confirmed and publicly disclosed, with an exploit available. No official remediation or patch has been released by the vendor as of the publication date.

Successful exploitation allows an unauthenticated remote attacker to induce the vulnerable server to make arbitrary HTTP requests. This can lead to information disclosure or interaction with internal systems not otherwise accessible. The medium CVSS score reflects the potential for partial impact on confidentiality, integrity, and availability, but no direct evidence of widespread exploitation or critical impact is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider implementing network-level controls to restrict outbound requests from the affected service and monitor for suspicious activity related to the baseURL parameter. Avoid exposing the vulnerable API to untrusted networks until a patch is available.