The issue is a Server‑Side Request Forgery where JunoClaw’s WAVS bridge calls fetch() on URLs supplied by an agent without checking the URL scheme, port, or resolved IP. This flaw is a CWE‑918 weakness that enables an attacker who can dictate the agent‑provided URL to trigger an outbound HTTP request from the host. The consequence is that the platform may inadvertently contact internal or cloud‑metadata services, leaking sensitive configuration, credentials, or other internal data and providing a foothold for further compromise. The standard description provided in the advisory notes this as a high‑severity flaw but does not imply remote code execution or denial of service on its own.

Dragonmonk111’s JunoClaw platform, releases before 0.x.y-security‑1, are affected. The vulnerability was fixed by the patch symbolized by the v0.x.y‑security‑1 release and all newer versions.

With a CVSS score of 8.2 the risk is assessed as high. EPSS is not available, but the absence of mitigations in the vulnerable releases means that exploitation would only require an agent capable of providing an arbitrary URL. The vulnerability is not catalogued in CISA KEV. The attack path is inferred to be an attacker‑controlled agent that can supply a crafted URL to computeDataVerify, causing the system to resolve and request that URL without restriction.