Z.AI Web Search

• Analyzed: May 12, 2026, 4:22 AM
• Findings: 1
• Version: 1.0.0
• Hash: 795d04bc2e47c9efce2ca6d37926483cd0de26e12df4379c8d1d4995f0558e64
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/extract.mjs` file is vulnerable to Server-Side Request Forgery (SSRF). It fetches content from arbitrary URLs provided as input without sufficient validation or restriction, allowing an attacker to potentially access internal network resources, cloud metadata endpoints, or other sensitive services from the agent's host. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior (e.g., exfiltration to an attacker-controlled domain, persistence, or obfuscation), classifying it as suspicious rather than malicious. Other files are benign.