CVE-2026-94040 vas3k CVE debrief

Who should care

Defenders responsible for systems using vas3k TaxHacker up to version 0.8.5 should assess their exposure and prioritize verifying the presence of this vulnerability in their systems.

Why it matters

Defenders should care about this vulnerability because it can lead to unauthorized requests from the server, potentially resulting in data breaches or system compromise. They should verify the presence of this vulnerability in their systems and prioritize patch application or mitigation.

• Potential unauthorized requests from the server
• Possible data breaches or system compromise
• Need for verification of vulnerability presence and patch application

Technical summary

The testLLMProviderAction function in the file app/(app)/apps/settings/actions.ts is vulnerable to server-side request forgery. The function can be manipulated through the provider, apiKey, model, and baseUrl arguments, potentially allowing for unauthorized requests to be made from the server. This vulnerability affects vas3k TaxHacker up to version 0.8.5 and has been publicly disclosed, with an exploit published. Defenders should assess their exposure and prioritize verifying the presence of this vulnerability in their systems.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems and applying patches or mitigations as soon as they become available.

Recommended defensive actions

• Verify the presence of this vulnerability in your systems
• Monitor for patches or mitigations from the vendor
• Implement compensating controls to prevent unauthorized requests
• Review system logs for suspicious activity
• Conduct a thorough risk assessment of exposed systems
• Prioritize patch application for critical systems
• Document and track remediation efforts

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the vendor has not yet responded to the issue report, and there is no information on official patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.