CVE-2026-85699

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85699 jina-ai reader server-side request forgery via redirect validation bypass

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-85699

jina-ai reader is affected by a server-side request forgery (SSRF) vulnerability. URL validation is applied only to the initial request but is not re-applied to subsequent redirect hops . An attacker can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, ...

EUVD-2026-71148

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the...

CVE-2026-82638 jina-ai reader Server-Side Request Forgery via disabled private-address guard

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content...

CVE-2026-82638

jina-ai reader disables its private-address guard outside Google Cloud deployments, creating a Server-Side Request Forgery (SSRF) vulnerability. The root cause lies in conditional logic (referenced in src/services/misc.ts) that only enforces the guard on GCP, leaving other environments exposed. A...

PT-2026-83558

Name of the Vulnerable Software and Affected Versions jina-ai reader affected versions not specified Description The software disables its private-address guard when deployed outside of Google Cloud environments, which enables unauthenticated attackers to perform server-side request forgery SSRF...

CVE-2026-18647

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

EUVD-2026-52435

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18647

The CVE concerns jina-ai reader (up to 1574bfd3…) with a flaw in isValidTLD in the Crawler/Puppeteer component (file backend/functions/src/cloud-functions/crawler.ts) that enables server-side request forgery. Remote exploitation is possible and the exploit has been publicly disclosed. Description...

CVE-2026-18647 jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...