PT-2026-33729 · Superagi · Superagi

Eric-Y · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6616

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions prior to 0.0.15

Description An issue in the WebScraperTool component within the file superagi/helper/webpage extractor.py allows for server-side request forgery, which is a flaw where an attacker can induce the server to make requests to an unintended location. This can be triggered remotely through the functions extract with bs4(), extract with 3k(), or extract with lxml().

Recommendations As a temporary workaround, consider restricting the use of the functions extract with bs4(), extract with 3k(), and extract with lxml() until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6616

Affected Products

Superagi

References · 6

• 🔥 https://gist.github.com/YLChen-007/4bb1d709cbb58cee46d839c651d3221f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6616 · Security Note
• https://vuldb.com/submit/791084 · Note
• https://vuldb.com/vuln/358251 · Note
• https://vuldb.com/vuln/358251/cti · Note
• https://twitter.com/VulmonFeeds/status/2046154530169962783 · Twitter Post