CVE-2026-108523

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file outboundTarget.ts of the component git-sources Browse API Endpoint. Executing a manipulation of the argument repo_url can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The presence of this vulnerability remains uncertain at this time. This patch is called 79b86ddcd4aefdd6941f098e35990ab397b13c72. It is advisable to implement a patch to correct this issue. The vendor explains: "Git repository access is an intentional, privileged administrative function. Sencho explicitly supports repositories hosted on private LAN, VPC, VPN, CGNAT, and IPv6 ULA networks. The report does not demonstrate a privilege-boundary bypass or access by an unprivileged user. We therefore dispute the CVE characterization of this behavior. As defense in depth, we have nevertheless hardened repository access. Git HTTPS and SSH connections now validate and pin DNS resolution, reject loopback, link-local, multicast, selected special-use and metadata targets, disable redirects and inherited proxy routing, and retain strict SSH host-key verification."

• CWE-918

• https://gist.github.com/jovair1994/93446c14d30a16313e830490d71bbd1d
• https://github.com/Studio-Saelix/sencho/
• https://github.com/Studio-Saelix/sencho/commit/79b86ddcd4aefdd6941f098e35990ab397b13c72
• https://github.com/Studio-Saelix/sencho/pull/1877
• https://vuldb.com/cve/CVE-2026-108523
• https://vuldb.com/submit/893367
• https://vuldb.com/vuln/416189
• https://vuldb.com/vuln/416189/cti

Published

Oct 11, 2026

Last Modified

Oct 11, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-108504ZTE Z80 Ultra has an unauthorized information disclosure vul…5.5
• CVE-2026-108505ZTE Z80 Ultra has a local information disclosure vulnerabili…3.3
• CVE-2026-108506ZTE Z80 Ultra's system interfaces do not have robust invocat…5.5
• CVE-2026-10852IBM WebSphere Application Server and IBM WebSphere Applicati…7.5
• CVE-2026-108521A vulnerability has been found in Studio-Saelix Sencho up to…4.7
• CVE-2026-108522A vulnerability was found in Studio-Saelix Sencho up to 0.94…8.3
• CVE-2026-10853IBM MQ could allow an authenticated attacker with cluster ac…8.8
• CVE-2026-108538A security vulnerability has been detected in GPAC up to 26.…6.3
• CVE-2026-108539A vulnerability was detected in GPAC up to 26.07.0. This aff…6.3
• CVE-2026-10854A visibility control issue in the event template creation wo…4.3
• CVE-2026-108545SillyTavern 1.12.13 through 1.19.0 contains a denial of serv…5.9
• CVE-2026-108546Spotweb through 1.5.8 contains an OS command injection vulne…7.5