The vulnerability is a server‑side request forgery exposed by the DocumentProcessingToolkit in the OWL project. The tool fetches URLs supplied by the caller without validating scheme, host, or IP address, and the value is derived from user prompts, enabling injection of arbitrary URLs. An attacker can cause the server to retrieve internal resources, and the retrieved data is returned to the agent context, potentially leaking confidential information or facilitating further attacks. This flaw is identified as CWE‑918.

The affected product is the OWL AI framework, specifically the DocumentProcessingToolkit component of the owl repository. The issue appears in all versions of owl where the extract_document_content function remains unpatched; the repository references indicate that the vulnerability was reported in issue 615. Affected deployments are those running the open-source version of owl exposed to untrusted prompt content.

The CVSS score of 8.7 classifies it as high severity. EPSS score is not available, so the exploitation probability cannot be quantified but the lack of filtering elevates the risk for privileged servers that host internal services. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely via any interface that feeds prompts to the toolkit; if the system accepts prompt injection, malicious URLs can be injected, leading to internal network reconnaissance or data exfiltration.