Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.9

xerrors Yuxi-Know lets attackers force server to call any URL

CVE-2025-14116 · published 11 months ago
Summary

The xerrors Yuxi-Know package (versions up to 0.4.0) contains a flaw in its embedding feature that can be tricked into sending requests to addresses of the attacker’s choice. This could let a remote user make the server talk to internal systems or external sites, potentially exposing data. Apply the vendor‑provided patch as soon as possible to stop the misuse.

Original advisory text
xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery
A vulnerability was detected in xerrors Yuxi-Know up to 0.4.0. This vulnerability affects the function OtherEmbedding.aencode of the file /src/models/embed.py. Performing manipulation of the argument health_url results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The patch is named 0ff771dc1933d5a6b78f804115e78a7d8625c3f3. To fix this issue, it is recommended to deploy a patch. The vendor responded with a vulnerability confirmation and a list of security measures they have established already (e.g. disabled URL parsing, disabled URL upload mode, removed URL-to-markdown conversion).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Dec 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-14116 · NVD
CVE-2025-14116 · OSV
Track software like this
Free during beta