---
id: CVE-2022-25850
aliases:
  - GHSA-5hjh-c26m-xw8w
  - SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228
title: ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
summary: ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: hoppscotch
product: github.com/hoppscotch/proxyscotch
ecosystem: go
affected:
  - github.com/hoppscotch/proxyscotch < 1.0.0
patched:
  - github.com/hoppscotch/proxyscotch 1.0.0
published: '2022-05-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:19.892395859Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5hjh-c26m-xw8w'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-25850'
  - url: >-
      https://github.com/hoppscotch/proxyscotch/commit/de67380f62f907f201d75854b76024ba4885fab7
  - url: 'https://github.com/hoppscotch/proxyscotch'
  - url: 'https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228'
tags:
  - osv
  - go
epss: 0.01373
epssPercentile: 0.70783
ingestedAt: '2026-09-12T03:13:01.756Z'
---

## Overview

ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.

## Affected packages

- `github.com/hoppscotch/proxyscotch < 1.0.0`

## Remediation

Upgrade to a patched release:

- `github.com/hoppscotch/proxyscotch 1.0.0`