CVE-2026-108850 Details

A server-side request forgery (SSRF) vulnerability has been identified in Company Research Agent versions through 2.2.0. This vulnerability allows unauthenticated attackers to inject unescaped ReportLab paragraph markup into the '/generate-pdf' endpoint, triggering outbound requests from the server. By embedding inline image elements with 'http' or 'https' sources in the 'report_content', attackers can make the server fetch internal or external resources. The fetched image responses are then leaked into the generated PDFs, while also providing a means to probe the reachability of internal services.

As of now, there is no fixed release available. However, the vulnerability can be addressed by escaping the 'report_content' before it is processed by ReportLab, to prevent injection of unescaped markup. Additionally, a ReportLab host allowlist should be configured to block unauthorized image fetches. If the application is not meant to be public, consider adding authentication to the '/generate-pdf' route and restricting outbound requests to only those necessary for the application's functionality.