Vulnerabilidades do Coze-dev Coze-studio
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Coze-dev Coze-studio: 2 registro(s), com versões afetadas e correções.
CVE-2026-92795
Média · 6.5
CWE-918 16/09/2026
Coze Studio through 0.5.1 Server-Side Request Forgery via Plugin
Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information.
CVE-2026-92788
Alta · 8.8
CWE-863 16/09/2026
Coze Studio through 0.5.1 Cross-Tenant Database Access via Workflow SQL Node
Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data.