Vulnerability Description
jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/jina-ai/reader
- https://github.com/jina-ai/reader/blob/1574bfd380d249c86c82db4dace0d9c8fe17e2b1/
- https://github.com/jina-ai/reader/blob/1574bfd380d249c86c82db4dace0d9c8fe17e2b1/
- https://github.com/jina-ai/reader/issues/1252
- https://www.vulncheck.com/advisories/jina-ai-reader-server-side-request-forgery-
- https://github.com/jina-ai/reader/issues/1252
FAQ
What is CVE-2026-85699?
CVE-2026-85699 is a vulnerability with a CVSS score of 7.5 (HIGH). jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a ...
How severe is CVE-2026-85699?
CVE-2026-85699 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85699?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.