CVE-2025-60541

High · 7.3

CVSS

7.3

EPSS

0.2%

Published

Nov 6, 2025

CISA due date

—

The record

A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.

Affected packages

Ecosystem	Package	Introduced	Fixed