What happened
CWE-918 SSRF in the agent's documentation-fetching tools. The tool fetches arbitrary client-supplied URLs and follows redirects, so an attacker who controls documentation content can chain indirect prompt injection into an SSRF reaching internal services or cloud metadata and feed the response back to the LLM. CVSS 8.7 (CVSS 4.0).
Why it matters
External content (docs) → injected instruction → server-side fetch to internal endpoints → sensitive data returned into model context. It weaponizes a benign 'reading documentation' capability into an internal-network disclosure channel.
Attack vector
fetch_docs and introspect (openapi/graphql kinds, and resolve_source docs_url) pass a client-supplied URL to URLSession with no scheme/host allowlist and follow redirects unconditionally. A prompt-injection payload embedded in fetched documentation steers the model to call fetch_docs against internal or metadata endpoints and stream the response back into the conversation.
Affected systems
PsychQuant liveDocs < 0.7.0
Mitigation
Upgrade to liveDocs 0.7.0 (GitHub GHSA-xf4p-x7v8-3x4p).