CVE-2026-15620CWE-918

mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery

Medium · published July 14, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
32.8
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in mosaxiv clawlet up to 0.2.10. This affects the function tools.webFetch of the file tools/tool_web_fetch.go. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The reported GitHub issue was closed with the label "not planned".

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00398 · 32.8th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-07-14T00:15Z
EPSS history
Timeline
  • 14 JUL 00:15Z
    mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery
    cvelistv5