ai-helper vulnerabilities

CVEs whose affected-version data names the ai-helper package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113671Medium· 4.3PoC

today

ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF

ApostropheCMS is an open-source Node.js content management system. From 1.0.0-beta.10 until 1.0.0-beta.13 of the AI helper, an editor with image-generation capability can create a base64-generated image record without a stored provider U…

▾ Twilightapostrophecms · apostrophevia CVEORG