The vulnerability resides in Sencho's git‑sources Browse API Endpoint, specifically the outboundTarget.ts module. By manipulating the repo_url parameter an attacker can cause the server to issue an outbound HTTP request to an arbitrary target. The change gives the attacker the ability to direct Sencho to internal or otherwise protected services, potentially exposing sensitive data or facilitating further network roll‑out. The weakness is a server‑side request forgery under CWE‑918. While the current report notes no privilege‑boundary bypass was demonstrated, the impact of SSRF remains significant.

Affected systems are Studio‑Saelix Sencho deployments running version 0.94.1 or earlier. The vulnerability is present in the code referenced by commit 79b86ddcd4aefdd6941f098e35990ab397b13c72, and any instance that has not applied the corresponding patch is susceptible.

The CVSS score of 5.3 indicates a medium severity, and the lack of an EPSS value or KEV listing suggests a moderate likelihood of exploitation at present, but the vulnerability has been publicly disclosed and can be triggered from the network. Because the attack requires remote code execution of a malformed repo_url, any environment exposing the Browse API could be targeted. Users should therefore treat the risk as moderate and act proactively.