3 results · Clear filters · Feed
-
High 7.5
jina-ai reader server-side request forgery via redirect validation bypass
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or …
-
High 7.5
jina-ai reader Server-Side Request Forgery via disabled private-address guard
jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud me…
-
High 7.3
jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manip…