Threats affecting pkg:github/coze-dev/coze-studio

Coze Studio versions up to 0.5.1 contain a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to make the backend server fetch internal services by supplying arbitrary server URLs when registering plugin tools. This can lead to unauthorized access to cloud metadata endpoints and internal services accessible only from the backend network, potentially exposing sensitive information.

Coze Studio versions up to 0.5.1 contain an authorization flaw where SQL customization nodes do not verify that table names belong to the caller's workspace. This allows authenticated attackers to enumerate table identifiers and perform unauthorized SQL operations on other workspaces' memory databases, including reading, inserting, or deleting data. The vulnerability has a high severity with a CVSS score of 8.7.