The vulnerability is a server‑side request forgery that permits any user to add arbitrary inline image tags in the report_content sent to the /generate‑pdf endpoint. Because the ReportLab engine processes that markup, the application performs outbound HTTP requests to the target URLs, fetching the hosts and including the responses inside the generated PDF. As a result, an attacker can make the server probe internal and external services and leak the returned content through the PDF output. This gives the attacker information about reachable hosts and possibly the contents of internal resources.

Affected versions are all releases of the open‑source Company Research Agent prior to and including version 2.2.0 provided by the vendor guy‑hartstein. No later releases are mentioned here, so only the versions listed below remain vulnerable. If your deployment is running any of those releases, it is impacted.

The CVSS score of 6.9 indicates a moderate level of severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication and relies on sending a crafted request to the publicly accessible /generate‑pdf endpoint; the failure of proper input validation is the root weakness (CWE‑918). Because the application is allowed to reach internal resources, a malicious attacker could use this route to discover services hidden behind firewalls, potentially leading to further exploitation of those services.