PT-2025-49320 · Unknown · Xerrors Yuxi-Know

Din4 · Published 2025-12-05 · Updated 2025-12-06 · CVE-2025-14116

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:L/Au:M/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xerrors Yuxi-Know versions up to 0.4.0

Description A server-side request forgery condition exists in the OtherEmbedding.aencode function within the /src/models/embed.py file. Manipulation of the health url argument can trigger this issue, allowing for remote exploitation. The vendor has confirmed the vulnerability and implemented security measures including disabling URL parsing, URL upload mode, and URL-to-markdown conversion. The exploit is publicly available.

Recommendations Deploy the patch 0ff771dc1933d5a6b78f804115e78a7d8625c3f3.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-14116

Affected Products

Xerrors Yuxi-Know

References · 10

• 🔥 https://notion.so/SSRF-vulnerablity-in-Yuxi-Know-2afea92a3c4180bea524f1a253f8d9a0?source=copy_link · Exploit
• https://github.com/xerrors/Yuxi-Know/commit/0ff771dc1933d5a6b78f804115e78a7d8625c3f3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-14116 · Security Note
• https://osv.dev/vulnerability/CVE-2025-14116 · Vendor Advisory
• https://t.me/cveNotify/144971 · Telegram Post
• https://t.me/CVEtracker/38971 · Telegram Post
• https://vuldb.com/?ctiid.334492 · Note
• https://vuldb.com/?submit.697380 · Note
• https://twitter.com/CVEnew/status/1997076129975619828 · Twitter Post
• https://vuldb.com/?id.334492 · Note