Vulnerability Description
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/pipeshub-ai/pipeshub-ai
- https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/module
- https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389
- https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0
- https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx
- https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-
FAQ
What is CVE-2026-119712?
CVE-2026-119712 is a vulnerability with a CVSS score of 6.4 (MEDIUM). PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding im...
How severe is CVE-2026-119712?
CVE-2026-119712 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119712?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.