Medium severity6.3NVD Advisory· Published Mar 9, 2026· Updated Apr 29, 2026
CVE-2026-3789
CVE-2026-3789
Description
A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java of the component SpringAIGiteeRestController. Performing a manipulation of the argument apiUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 1.4.5.4 is able to address this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is advised.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/Bytedesk/bytedesk/commit/975e39e4dd527596987559f56c5f9f973f64eff7nvdPatch
- github.com/Bytedesk/bytedesk/issues/21nvdExploitVendor Advisory
- github.com/Bytedesk/bytedesk/issues/21nvdExploitVendor Advisory
- github.com/Bytedesk/bytedesk/issues/21nvdExploitVendor Advisory
- vuldb.comnvdThird Party AdvisoryVDB Entry
- vuldb.comnvdThird Party AdvisoryVDB Entry
- github.com/Bytedesk/bytedesk/releases/tag/v1.4.5.4nvdRelease Notes
- vuldb.comnvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.