Threats affecting pkg:npm/huimeicloud/hm_editor

CVE-2026-5346 is a server-side request forgery (SSRF) vulnerability in huimeicloud hm_editor versions up to 2.2.3. The vulnerability exists in the client.get function within the src/mcp-server.js file, specifically in the image-to-base64 endpoint. By manipulating the url argument, an attacker can cause the server to make unintended requests. The vulnerability can be exploited remotely and has been publicly disclosed. The vendor has not responded or provided a patch. The CVSS 4.