This vulnerability, identified as a CWE‑348 weakness, allows an unauthenticated attacker to alter the HTTP Origin used by the Szafir SDK Web plug‑in when launching the SzafirHost application. Because the plug‑in performs no validation on the document_base_url parameter, the attacker can redirect the application call to any address, which is then shown in the user confirmation prompt. If the victim confirms or selects “remember”, the application runs with the attacker‑supplied arguments and may download additional files or libraries from the attacker’s site, potentially leading to execution of malicious code.

The flaw affects the Szafir SDK Web plug‑in distributed by Krajowa Izba Rozliczeniowa. All releases prior to version 0.0.17.4 are vulnerable. The issue was resolved in 0.0.17.4; applying that upgrade removes the vulnerability.

The CVSS score of 5.1 indicates medium severity. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, suggesting limited exposure in the wild. The likely attack vector involves a malicious web page that triggers the plug‑in to launch SzafirHost with forged parameters; once the user accepts the confirmation prompt, the attacker’s site controls the application context and can download arbitrary content. Selecting the “remember” option elevates the risk by bypassing future prompts and enabling silent execution.