The vulnerability is an SSRF flaw in the buildImapConfig function of the Email Sync component of vas3k TaxHacker, where manipulating the host and port arguments can cause the server to issue requests to arbitrary URLs. This allows an attacker to force the application to resolve and connect to any TCP endpoint that the device has network access to. The impact of exploiting this flaw is the ability to access internal resources or external services from the victim’s machine, leading to potential data exfiltration or internal network reconnaissance.

vulnerable versions of vas3k TaxHacker up to 0.8.2 contain the flaw in lib/email-sync/imap-client.ts. No releases beyond 0.8.2 are listed as fixed, so any deployment using these or earlier versions is affected.

The CVSS score of 5.3 indicates a moderate severity for this SSRF, and the EPSS score is not available. It is not listed in CISA KEV, so no public exploits have been confirmed. The flaw can be triggered remotely by supplying crafted host/port values, with no special authentication required. The lack of an accepted patch means the risk remains until a fix is released or mitigated through network controls.