{"data":{"id":"6b4e9689-afdf-44f2-bf26-a28bfe04e5ca","title":"CVE-2026-7177: A security flaw has been discovered in ChatGPTNextWeb NextChat up to 2.16.1. Affected by this issue is the function…","summary":"CVE-2026-7177 is a server-side request forgery flaw in ChatGPTNextWeb NextChat up to 2.16.1. It sits in the proxyHandler function of app/api/[provider]/[...path]/route.ts, and remote attackers can trigger it. The exploit has been released publicly, and the project was informed through an issue report but had not responded at the time of the source.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-7177","publishedAt":"2026-04-27T22:16:18.860Z","cveId":"CVE-2026-7177","cweIds":["CWE-918"],"cvssScore":"7.3","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["NextChat","ChatGPTNextWeb NextChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"NextChat server-side request forgery in proxyHandler route","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00356,"epssCheckedAt":"2026-11-09T18:09:51.702Z","kevDateAdded":null,"advisoryAliases":["GHSA-ff75-fg5h-fjx7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T12:11:04.976Z","patchAvailable":null,"disclosureDate":"2026-04-27T22:16:18.860Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}