EUVD-2026-80902

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719 Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

Quickwit through 0.9.0 fails to validate the host and scheme of the queueurl parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queueurl to the create-source API to scan internal networks and...

CVE-2026-92719

Quickwit through 0.9.0 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its SQS file sources . The root cause is a failure to validate the host and scheme of the queue_url parameter, allowing an unauthenticated attacker to supply a malicious value via the create-source API and...

MAL-2025-1517 Malicious code in quickwit-ui (npm)

This package runs commands on import that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac59f539efc4d8596e823182d97cdc7a461e965894dec0aabb807585cd5c92ea Any computer that has this package installed or running...

Malicious code in quickwit-ui (npm)

This package runs commands on import that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac59f539efc4d8596e823182d97cdc7a461e965894dec0aabb807585cd5c92ea Any computer that has this package installed or running...