The flaw resides in the webFetch function of mosaxiv clawlet, where an attacker can supply a crafted URL that the server blindly requests. This server‑side request forgery (CWE‑918) enables the attacker to force the host to reach arbitrary external or internal endpoints, potentially exposing internal data or performing unauthorized scans. The vulnerability is triggered remotely via the tool’s webFetch endpoint and does not cause denial of service; its primary danger lies in confidentiality and integrity compromise.

Users who installed mosaxiv clawlet versions up to and including 0.2.10 are affected. No newer releases are documented, so any installation of this or earlier releases should be considered vulnerable until a patch becomes available.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of < 1% indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but the publicly posted GitHub issue and external advisory confirm that the attack can be launched remotely from outside the protected network. The likely attack vector involves submitting a malicious URL to the webFetch endpoint, which causes the server to make an HTTP request to the target address, potentially revealing internal resources or data. Without an official fix or workaround, the risk remains until a newer version or vendor patch is released.