PT-2026-33729 · Transformeroptimus · Superagi

Eric-Y · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6616

Mitre

CVSS v3.1

6.3

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract with bs4/extract with 3k/extract with lxml of the file superagi/helper/webpage extractor.py of the component WebScraperTool. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-6616

Affected Products

Superagi

References · 5

• 🔥 https://gist.github.com/YLChen-007/4bb1d709cbb58cee46d839c651d3221f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6616 · Security Note
• https://vuldb.com/submit/791084 · Note
• https://vuldb.com/vuln/358251 · Note
• https://vuldb.com/vuln/358251/cti · Note