The scalar/astro v0.1.13 Proxy endpoint accepts a scalar_url query parameter used to fetch a remote resource. The parameter is not authenticated or validated, allowing any attacker‑controlled URL to be requested. This Server‑Side Request Forgery lets unauthenticated attackers force the backend to send HTTP requests to external or internal hosts, potentially leaking authentication cookies or headers and enabling privilege escalation. As a CWE‑918 flaw, the vulnerability can expose sensitive session data and compromise account integrity.

The issue is limited to scalar/astro v0.1.13. The Scalar Proxy endpoint accepts the scalar_url parameter. No vendor product list is provided beyond scalar/astro. The SSRF flaw applies only to that specific version.

The CVSS score of 9.8 indicates extremely high severity. The EPSS score is less than 1%, suggesting a low current probability of exploitation, and the vulnerability is not cataloged in the CISA KEV. The likely attack vector is an unauthenticated HTTP request to the exposed endpoint with a crafted scalar_url. No special authentication or privileges are required on the backend to trigger the SSRF; an attacker only needs to send a request to that endpoint. If the backend includes authentication cookies or headers, they may be forwarded to the target URL, allowing credential leakage or other compromise.