CVE-2026-91199

🗓️ 14 Sep 2026 22:10:56Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 28 Views🌐 WEB

SSRF in Refly through 1.1.0 scrape endpoint allows reading internal page titles and descriptions.

Reporter	Title	Published	Views	Family All 6
Cvelist	CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint	14 Sep 202622:10	–	cvelist
EUVD	EUVD-2026-78208	15 Sep 202600:31	–	euvd
NVD	CVE-2026-91199	14 Sep 202623:19	–	nvd
Positive Technologies	PT-2026-91757	14 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-91199: Server-Side Request Forgery (SSRF)	14 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-91199 Refly through 1.1.0 Server-Side Request Forgery via scrape endpoint	14 Sep 202622:10	–	vulnrichment

Vulners

Node

refly-ai reflyRange0–1.1.0

[
  {
    "vendor": "refly-ai",
    "product": "refly",
    "defaultStatus": "unaffected",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "semver",
        "lessThanOrEqual": "1.1.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/apps/api/src/modules/misc/misc.controller.ts
github	www.github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/packages/utils/src/scrape-weblink.ts
vulncheck	www.vulncheck.com/advisories/refly-through-1.1.0-server-side-request-forgery-via-scrape-endpoint
github	www.github.com/refly-ai/refly
github	www.github.com/refly-ai/refly/issues/2280

Parameter	Position	Path	Description	CWE
url	request body	/v1/misc/scrape	SSRF: POST /v1/misc/scrape accepts a caller-supplied URL in the request body and fetches it without validating scheme/host/address, enabling requests to loopback/private/link-local addresses including cloud metadata services to read page titles/descriptions of internal resources.	CWE-918

24 Sep 2026 14:22Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15

CVSS 45.3

EPSS0.00342

SSVC

CWE-918