The vulnerability lies in how TheLibrarian’s supervisord status page can be fetched via the web_fetch tool, allowing entities that control web_fetch to enumerate running processes on the backend. This disclosure can reveal internal application state, potentially aiding further attacks or providing insight into system configuration. The weakness corresponds to inadequate protection of sensitive process information.

This issue affects TheLibrarian.io’s TheLibrarian service. All versions of the product are considered impacted until the vendor releases a fix. No specific version range is listed, but the vendor has confirmed a fix in all affected versions.

The CVSS base score of 7.3 indicates a high severity potential impact. Although the EPSS score is below 1%, indicating low current exploitation probability, the vulnerability remains exploitable without authentication if the web_fetch path is reachable. The vulnerability is not yet present in the CISA KEV catalog. An attacker who can send crafted requests to the status page—likely through web_fetch—could retrieve the process list. Mitigation requires updating to the vendor’s patched release or implementing network controls to block unauthenticated access to the endpoint.