VulnSocial

CVE-2026-94040Disclosure

LOWCVSS 5.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-20); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-20: 1Mentions · 2026-10-20: 1Patch / Workaround · 2026-10-20: 1Technical Details · 2026-09-20: 1Technical Details · 2026-10-20: 109-2010-20
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-201
Disclosure1
2026-10-201
Patch1
Full discourse2 posts
  • Hugo | DevOps | Cybersecurity@HugoValters
    Patch

    CVE-2026-94040: SSRF in vas3k TaxHacker up to 0.8.5, CVSS 5.3. Public exploit exists, no vendor response, unpatched. Restrict outbound requests and patch now. #CVE #infosec #cybersecurity https://www.valtersit.com/cve/CVE-2026-94040 #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text discloses CVE-2026-94040 (SSRF in vas3k TaxHacker, CVSS 5.3), notes a public exploit exists, and explicitly calls for patching and implementing a workaround (restricting outbound requests). The primary classification is Patch due to the explicit 'patch now' directive.

    0000036
    1.1K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-94040 A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions… https://www.cve.org/CVERecord?id=CVE-2026-94040

    Post summary

    The text announces a vulnerability in vas3k TaxHacker up to 0.8.5 and identifies the affected function and file. It does not mention PoC, exploit tooling, active exploitation, patching, or remediation.

    000001.7K
    58.1K followersView on X

Explore more

Back to dashboard