CVE-2026-5346: huimeicloud hm_editor SSRF Vulnerability

CVE-2026-5346 Overview

CVE-2026-5346 is a server-side request forgery (SSRF) vulnerability in huimeicloud hm_editor versions up to 2.2.3. The flaw resides in the client.get function within src/mcp-server.js, which handles the image-to-base64 endpoint. An unauthenticated attacker can manipulate the url argument to force the server to issue arbitrary outbound HTTP requests. The exploit has been publicly disclosed on GitHub, and the vendor did not respond to early disclosure attempts. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Remote attackers can coerce the hm_editor server into making arbitrary requests to internal services, cloud metadata endpoints, or other unintended destinations without authentication.

Affected Products

huimeicloud hm_editor versions up to and including 2.2.3
The image-to-base64 endpoint exposed by src/mcp-server.js
Deployments using the vulnerable client.get function

Discovery Timeline

2026-04-02 - CVE-2026-5346 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5346

Vulnerability Analysis

The vulnerability stems from insufficient validation of a user-supplied URL parameter in the image-to-base64 endpoint. The endpoint accepts a url argument and passes it directly to the client.get function defined in src/mcp-server.js. The server fetches the remote resource and returns its base64-encoded representation to the requester. Because no allow-list, scheme restriction, or host validation is enforced, attackers can supply URLs targeting internal network resources. The disclosure indicates the exploit is public, increasing the likelihood of opportunistic abuse against exposed deployments.

Root Cause

The root cause is missing input validation on a network-bound parameter. The client.get consumer treats the attacker-controlled url as a trusted input and issues an HTTP request without restricting destinations. There is no enforcement of scheme (http/https only), no blocklist for private IP ranges (RFC 1918), loopback addresses, or link-local metadata endpoints (169.254.169.254), and no DNS resolution checks to prevent rebinding.

Attack Vector

An unauthenticated remote attacker sends a request to the image-to-base64 endpoint with a crafted url parameter. Typical SSRF targets include cloud instance metadata services to extract IAM credentials, internal administrative interfaces that trust requests from localhost, and reachable services on adjacent network segments. The attacker can also use the server as a proxy for reconnaissance against the internal network. Refer to the public exploit discussion and VulDB entry #354701 for technical detail.

Detection Methods for CVE-2026-5346

Indicators of Compromise

Outbound HTTP requests originating from the hm_editor process to private IP ranges, loopback addresses, or 169.254.169.254
Access log entries against the image-to-base64 endpoint containing non-image URLs or unusual schemes
Anomalous spikes in outbound traffic from the hm_editor host to internal subnets

Detection Strategies

Inspect web access logs for requests to the image-to-base64 endpoint and review the url parameter for internal hostnames, IP literals, or non-standard schemes
Correlate hm_editor process network telemetry against an allow-list of expected upstream destinations
Deploy egress filtering alerts that flag attempts from application servers to cloud metadata endpoints

Monitoring Recommendations

Forward application and proxy logs to a centralized analytics platform and alert on SSRF signatures targeting image-to-base64
Monitor outbound DNS queries from the hm_editor host for resolution of internal domains
Track failed and successful credential retrieval attempts against cloud IAM metadata services

How to Mitigate CVE-2026-5346

Immediate Actions Required

Restrict or disable the image-to-base64 endpoint until a vendor patch is available
Place the hm_editor service behind egress controls that block traffic to private, loopback, and metadata IP ranges
Require authentication on any administrative or content-processing endpoint exposed to untrusted networks

Patch Information

No vendor patch has been published. The disclosure record notes the vendor was contacted prior to publication but did not respond. Track the VulDB advisory and the upstream GitHub issue for fix availability.

Workarounds

Implement a URL allow-list in a reverse proxy in front of hm_editor that limits the url parameter to expected public image hosts
Enforce IMDSv2 on cloud workloads to mitigate metadata credential theft via SSRF
Run the application in a network segment with strict egress firewall rules that deny traffic to RFC 1918 ranges and 169.254.0.0/16

bash

# Example egress restriction using iptables on the hm_editor host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP