CVE-2026-121936— easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

Quick assessment

Affected

cosin2077 easyVoice

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 0.0.23 版本之前的 easyVoice 存在服务端请求伪造（SSRF）漏洞。未认证的攻击者可通过启用 useLLM 并传入 openaiBaseUrl 参数，诱导服务器发送 POST 请求。攻击者可利用 /api/v1/tts 端点，针对回环地址及内部服务发起攻击，并通过 x-generate-tts-warning 响应头中反射的错误消息来探测内部主机和端口。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1046 · Network Service Discovery T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

easyVoice before 0.0.23 SSRF via openaiBaseUrl in TTS API

Source: CVE Program / CVE List V5

Vulnerability Description

easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
cosin2077	easyVoice	0 ~ 0.0.23	-

II. Public POCs for CVE-2026-121936

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121936

请登录查看更多情报信息。

Other References for CVE-2026-121936 (6)

https://github.com/cosin2077/easyVoice/issues/87 issue-tracking
https://github.com/cosin2077/easyVoice/commit/82fcb5b2f324c84b3f1808b29c6f44df16ccd42e patch
https://github.com/cosin2077/easyVoice/blob/be08c5f3fed07f3af749defcf04e590ffcb0c48d/packages/backend/src/utils/ssrf.ts#L28-L47 technical-description
https://github.com/cosin2077/easyVoice/pull/88 issue-tracking patch
https://github.com/cosin2077/easyVoice/releases/tag/v0.0.23 release-notes
https://www.vulncheck.com/advisories/easyvoice-before-0.0.23-ssrf-via-openaibaseurl-in-tts-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121936

IV. Related Vulnerabilities

Same weakness: CWE-918