Helicone through v2025.08.21‑1 suffers a server‑side request forgery flaw in the Jawn Webhook Sender. Authenticated organization users can configure webhooks that point to domain names which resolve to private or loopback addresses. The application then silently follows the DNS resolution and issues POST requests, giving attackers the ability to reach internal HTTPS services without external network exposure. This is an instance of CWE‑918, allowing an attacker to force the server to contact internal resources.

Helicone, the open‑source data inference platform, is affected. Versions up to and including v2025.08.21‑1 contain the flaw. Users running this version or earlier must identify the vulnerability.

The CVSS base score is 5.3, indicating moderate severity. No EPSS data is published, so the probability of exploitation cannot be quantified, and the vulnerability is not yet recorded in CISA's KEV catalog. The attack requires the attacker to be an authenticated organization member with permission to create webhooks, but does not need external network access. Once the exploit path is established, an attacker can silently contact any internal service reachable from the Helicone host, potentially exfiltrating data or performing further attacks. The relatively modest CVSS score does not fully capture the potential damage if an internal service is critical. This vulnerability is actionable, and appropriate remediations are available.