Executive brief
Jina AI Reader is a service that converts web pages into LLM-friendly formats for AI processing. The service validates URLs only on initial requests but fails to re-validate after HTTP redirects, allowing attackers to craft malicious public URLs that redirect to internal networks or cloud metadata services, exposing sensitive data to the attacker.
Technical details
The vulnerability is a server-side request forgery (SSRF) resulting from incomplete URL validation in the redirect handling logic. The vulnerable component (curl.ts) validates the initial URL against a blocklist but does not re-apply validation to the target of HTTP redirects. An attacker can host a public server that responds with a redirect pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254 AWS metadata) or private cloud endpoints. When the Reader service follows the redirect, it fetches the response from the internal target and returns the body to the attacker. No authentication is required—an attacker only needs to craft the initial URL and wait for the service to fetch it. Patches are available in the GitHub repository.
Affected products
- jina-ai reader prior to fix
Timeline
- 2026-09-04: disclosed
- other: CVE-2026-85699 assigned