Threats affecting pkg:github/easyVoice

CVE-2026-121936 is a server-side request forgery (SSRF) vulnerability in cosin2077 easyVoice versions before 0.0.23. It allows unauthenticated attackers to make the server send POST requests by manipulating the openaiBaseUrl parameter when useLLM is enabled. Attackers can exploit this to target internal and loopback services via the /api/v1/tts endpoint and use reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). A fix is available in version 0.0.23.