The vulnerability arises when an authenticated user supplies an arbitrary feed URL. The server then performs the requested HTTP or HTTPS call, enabling the attacker to send requests to internal or cloud services. The flaw can be leveraged to read sensitive data, query internal APIs, or access cloud metadata endpoints such as AWS IMDS. The weakness corresponds to CWE‑918, an injection‑like behavior that bypasses normal controls.

Stringer, the self‑hosted anti‑social RSS reader, is affected by all releases before commit 75cb0955919a362ac49d23c8a14892d0f59ea1c4. The vulnerability is present for any instance where the application accepts user‑supplied feed URLs. Users who have permission to add feeds or, if self‑service signup is enabled, any registered user can trigger the flaw.

The CVSS base score is 7.6, indicating a high impact if exploited. Because the issue requires authentication, an attacker must first log in, but even low‑privileged users can use the flaw. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation typically involves sending to a localhost address, an internal service, or a cloud metadata IP, potentially exposing internal networks or cloud credentials.