A server‑side request forgery flaw exists in the worldquant‑miner application through the unvalidated handling of the make_request argument in ssrf_proxy.py, allowing an attacker to cause the server to forward requests to arbitrary URLs. The vulnerability has a reported CVSS score of 6.3, indicating moderate severity, and the exploitability is considered difficult with high complexity. The impact can include unauthorized access to internal services, exfiltration of sensitive data, or disruption of services by relaying malicious requests, though the specific damage to confidentiality or integrity is not detailed in the description.

The flaw affects installations of the worldquant‑miner application, released by zhutoutoutousan, for all versions up to and including 1.0.9. Any deployment using the worldquant‑miner-master/agent-dify-api/core/helper/ssrf_proxy.py module is potentially vulnerable.

The CVSS score of 6.3 reflects a moderate exploit risk, while the EPSS score of < 1 % suggests a low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. Attackers could trigger the SSRF remotely by providing crafted input to the make_request function, provided they have network access to the target server. Due to the high complexity and difficulty rating, successful exploitation would require significant effort and a detailed understanding of the target’s internal network topology.