PT-2026-20650 · Zhutoutoutousan · Worldquant-Miner

Zast.Ai · Published 2026-02-19 · Updated 2026-05-05 · CVE-2026-2711

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions zhutoutoutousan worldquant-miner versions through 1.0.9

Description A server-side request forgery issue exists in zhutoutoutousan worldquant-miner. The issue is related to the manipulation of the make request argument within an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf proxy.py in the URL Handler component. The attack can be initiated remotely and is considered to have high complexity and difficult exploitability. The exploit has been publicly disclosed.

Recommendations Versions prior to 1.0.9 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2711

Affected Products

Worldquant-Miner

References · 12

• 🔥 https://github.com/zhutoutoutousan/worldquant-miner/issues/100#issue-3905756578 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2711 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2711 · Vendor Advisory
• https://github.com/zhutoutoutousan/worldquant-miner/issues/100 · Note
• https://vuldb.com/?ctiid.346662 · Note
• https://github.com/zhutoutoutousan/worldquant-miner · Note
• https://twitter.com/zast_ai/status/2051698208796291212 · Twitter Post
• https://vuldb.com/?submit.753320 · Note
• https://vuldb.com/?id.346662 · Note
• https://twitter.com/CVEnew/status/2024501260771283379 · Twitter Post
• https://t.me/CVEtracker/45092 · Telegram Post
• https://twitter.com/geng_zast/status/2051695182501028169 · Twitter Post