CVE-2026-7223

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2026
Source publication: Apr 28, 2026
Source updated: Apr 28, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery

A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

HyperChat

Vendor: BigSweetPotatoStudio
Product: HyperChat
Platforms: Unknown
Default status: Unknown

HyperChat · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.0.0-alpha.0	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.1	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.2	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.3	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.4	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.5	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.6	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.7	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.8	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.9	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.10	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.11	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.12	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.13	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.14	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.15	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.16	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.17	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.18	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.19	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.20	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.21	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.22	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.23	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.24	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.25	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.26	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.27	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.28	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.29	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.30	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.31	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.32	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.33	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.34	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.35	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.36	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.37	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.38	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.39	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.40	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.41	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.42	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.43	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.44	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.45	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.46	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.47	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.48	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.49	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.50	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.51	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.52	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.53	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.54	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.55	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.56	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.57	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.58	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.59	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.60	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.61	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.62	`affected`	Unavailable	Unavailable	Unavailable	None listed
2.0.0-alpha.63	`affected`	Unavailable	Unavailable	Unavailable	None listed