A vulnerability was found in zhutoutoutousan worldquant-miner up to 1.0.9. It has been rated as critical. The impacted element is an unknown function of the file worldquant-miner-master/agent-dify-api/core/helper/ssrf_proxy.py of the component URL Handler. The manipulation of the argument make_request leads to server-side request forgery.
This vulnerability is documented as CVE-2026-2711. The attack can be initiated remotely. Additionally, an exploit exists.
The project was informed of the problem early through an issue report but has not responded yet.
