Qwen-Agent through 0.0.34 is vulnerable to a server‑side request forgery flaw in its document parsing routine. The server accepts any caller‑supplied path as a URL without enforcing the presence of a scheme or checking the host, allowing an attacker to trick the application into treating arbitrary strings as internal URLs. When the Gradio interface—which is unauthenticated— is invoked with a crafted document URL, the server performs outbound HTTP requests to the specified host and incorporates the retrieved content into the parsed output. This flaw permits the exfiltration of internal data, such as cloud metadata services, and can serve as a pivot for further attacks, compromising confidentiality and potentially enabling downstream exploitation.

The vulnerability affects QwenLM's Qwen-Agent version 0.0.34. The affected product is the Qwen-Agent server component that hosts a Gradio user interface. To mitigate the issue, any deployments of Qwen-Agent running 0.0.34 must be updated.

This flaw carries a CVSS score of 8.7, indicating high severity. Because the vulnerable endpoint is publicly reachable through the Gradio UI, attackers need only an unauthenticated web session to craft a URL and trigger the request. No exploit code is publicly available, but the lack of host validation makes the attack trivial to execute. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the unauthenticated nature and high CVSS score warrant immediate attention.