[HIGH] URL Construction Injection - CVE-HSYNC-2026-004

[luthien-m]

Security Vulnerability Report

Severity: HIGH (CVSS 7.5)
File: connection.js

Description

Dynamic host connections construct URLs from unvalidated user input, potentially allowing URL injection and SSRF attacks.

Vulnerable Code

const result = await fetch.post(`${dynamicHost}/${hsyncBase}/dyn`, {});

Impact

• SSRF attacks
• URL injection
• Potential access to internal services

Recommendation

Validate and sanitize dynamicHost input before URL construction.

References

• Found during security audit of hsync reverse proxy
• Part of comprehensive security review identifying 13 vulnerabilities