# CVE-2026-18647: Jina AI Reader server-side request forgery in URL validation

Source: https://junglewise.ai/threats/cve-2026-18647-jina-ai-reader-server-side-request-forgery-in-url-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18647 · Severity: high · CVSS 7.3 · Published 2026-08-03

Jina AI Reader is a service that fetches and renders web pages on behalf of users. A flaw in its URL validation allows remote attackers to bypass security checks and force the server to access internal resources, including cloud metadata endpoints that contain sensitive credentials, private networks, and internal services. No authentication is required to exploit this vulnerability.

## Quick answers

**Is CVE-2026-18647 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18647 being exploited in the wild.

**How severe is CVE-2026-18647?** High severity, with a CVSS score of 7.3, published 3 August 2026.

**Which products and versions are affected?** Jina AI Reader Up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1.

**Is there a fix for CVE-2026-18647?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18647 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-18647?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the Reader service due to two insufficient URL validation checks. The isValidTLD() function in crawler.ts only verifies that the hostname contains a dot and the last segment is ≥2 characters—this allows IPv4 addresses like 169.254.169.254 (AWS metadata) to pass, while incorrectly blocking 127.0.0.1. The Puppeteer request interceptor in puppeteer.ts only blocks localhost and 127.x.x.x, missing private IP ranges (10.0.0.0/8, 172.16-31.x.x, 192.168.x.x), IPv6 loopback, and cloud metadata endpoints. An unauthenticated remote attacker can craft HTTP requests to internal IP addresses, enabling access to cloud IAM credentials, internal network scanning, and internal service compromise. The vendor did not respond to early disclosure.

## Affected products

- Jina AI Reader Up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1

## Timeline

- 2026-06-10: disclosed: Issue opened on GitHub (orionyan520/cve_report)
- 2026-08-03: disclosed: CVE-2026-18647 published on NVD
- 2026-08-03: other: Vendor contacted early but did not respond

## References

- [https://github.com/orionyan520/cve_report/issues/8](https://github.com/orionyan520/cve_report/issues/8)
- [https://vuldb.com/cve/CVE-2026-18647](https://vuldb.com/cve/CVE-2026-18647)