SmythOS sre, up to version 0.0.15, contains a weakness in the Connector Service’s utils.ts component that allows manipulation of the baseURL argument to reveal sensitive information. The flaw is characterized by improper input validation and inadequate access controls, as reflected by CWE‑200 and CWE‑284. An attacker can trigger the disclosure remotely, exposing data that should be protected by confidentiality requirements.

The affected product is SmythOS sre. All installations of versions 0.0.15 and earlier are vulnerable; the precise function that is compromised lives in packages/sdk/src/LLM/utils.ts.

The CVSS score of 5.1 places the vulnerability in the medium risk range, and the EPSS score of less than 1% indicates that, at present, the probability of real‑world exploitation is low. However, the issue is not listed in the CISA KEV catalog, which could allow it to be overlooked. The attack vector is inferred to be remote based on the description, and the disclosure is publicly available, meaning that an attacker could exploit it without prior interaction with the vendor.