Helium is a student planning platform that lets authenticated users post links to external calendar feeds. Before version 2.2.60 the service accepts any URL, does no domain validation, and forwards it to urllib.request.urlopen. When the system later refetches these URLs, the response codes or errors are forwarded to the user. This mechanism allows a malicious user to have the Helium server issue outbound requests to arbitrary hosts, including internal addresses. By examining the server’s response or the remote disconnection error, an attacker can infer whether an internal host or service is reachable, facilitating reconnaissance.

HeliumEdu’s open‑source platform is vulnerable for all releases earlier than 2.2.60. The weakness is triggered by POST /feed/externalcalendars/ where any authenticated session may supply a user‑supplied URL to the icalexternalcalendarservice. The vulnerability exists in all older deployments of the Helium code base, and is fixed starting with commit f0de5c985c and version 2.2.60.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of <1% signifies a low probability of exploitation in the wild. Since the flaw requires authentication, only users who already have legitimate access to the Helium platform can use it. The impact is limited to forced outbound traffic and the ability to map internal services; it does not allow direct retrieval of credentials or other sensitive data in this advisory. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploit. Nevertheless, attackers could send low‑privilege probes as part of a broader reconnaissance campaign.