Executive brief
Jina AI Reader is a service that fetches and renders web pages on behalf of users. A flaw in its URL validation allows remote attackers to bypass security checks and force the server to access internal resources, including cloud metadata endpoints that contain sensitive credentials, private networks, and internal services. No authentication is required to exploit this vulnerability.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the Reader service due to two insufficient URL validation checks. The isValidTLD() function in crawler.ts only verifies that the hostname contains a dot and the last segment is ≥2 characters—this allows IPv4 addresses like 169.254.169.254 (AWS metadata) to pass, while incorrectly blocking 127.0.0.1. The Puppeteer request interceptor in puppeteer.ts only blocks localhost and 127.x.x.x, missing private IP ranges (10.0.0.0/8, 172.16-31.x.x, 192.168.x.x), IPv6 loopback, and cloud metadata endpoints. An unauthenticated remote attacker can craft HTTP requests to internal IP addresses, enabling access to cloud IAM credentials, internal network scanning, and internal service compromise. The vendor did not respond to early disclosure.
Affected products
- Jina AI Reader Up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1
Timeline
- 2026-06-10: disclosed: Issue opened on GitHub (orionyan520/cve_report)
- 2026-08-03: disclosed: CVE-2026-18647 published on NVD
- 2026-08-03: other: Vendor contacted early but did not respond