Server-Side Request Forgery in Yuxi-Know by xerrors
CVE-2025-14116

5.1MEDIUM

Key Information:

Vendor

Xerrors

Status
Yuxi-know
Vendor
CVE Published:
5 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-14116?

A vulnerability has been identified in Yuxi-Know by xerrors affecting versions up to 0.4.0. Specifically, the vulnerability resides in the OtherEmbedding.aencode function within the /src/models/embed.py file. An attacker can exploit this weakness through manipulation of the health_url argument, potentially leading to a server-side request forgery (SSRF) condition. This vulnerability can be executed remotely, making it particularly concerning. To mitigate this issue, it is recommended to apply the patch identified by commit 0ff771dc1933d5a6b78f804115e78a7d8625c3f3. The vendor has acknowledged the issue and implemented security measures, such as disabling URL parsing and upload mode, as well as removing URL-to-markdown conversion functionalities.

Affected Version(s)

Yuxi-Know 0.1

Yuxi-Know 0.2

Yuxi-Know 0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-14116 - Proof of Concept

References

https://vuldb.com/?id.334492
vdb-entrytechnical-description
https://vuldb.com/?ctiid.334492
signaturepermissions-required
https://vuldb.com/?submit.697380
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

din4 (VulDB User)
JSON
.
CVE-2025-14116 : Server-Side Request Forgery in Yuxi-Know by xerrors