request-baskets vulnerable to Server-Side Request Forgery

MEDIUM 6.5CVE-2023-27163 · GHSA-58g2-vgpg-335q · Published 31/03/2023 · updated 09/07/2026

In short

CVE-2023-27163 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/darklynx/request-baskets, request baskets (rbaskets).
Chance of exploitation in the next 30 days (EPSS): 6.5%, higher than 93.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
github.com/darklynx/request-baskets Go	`≤ 1.2.1`	No fix yet
request baskets rbaskets	`≤ 1.2.1`	No fix yet

Description

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-27163 · ADVISORY
gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3 · WEB
darklynx/request-baskets · PACKAGE
notes.sjtu.edu.cn/s/MUUhEymt7 · WEB
packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html · WEB
packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html · WEB
request-baskets.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

In short

CVE-2023-27163 is a MEDIUM (CVSS 6.5) vulnerability affecting github.com/darklynx/request-baskets, request baskets (rbaskets).

Chance of exploitation in the next 30 days (EPSS): 6.5%, higher than 93.8% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

github.com/darklynx/request-baskets

≤ 1.2.1

No fix yet

request baskets

rbaskets

≤ 1.2.1

No fix yet

Description

NVD description