Executive brief
NonceGeek dim-sum-app is an AI search system that processes requests through a Deno backend. A server-side request forgery vulnerability in the text search function allows remote attackers to manipulate the Supabase URL parameter, potentially enabling unauthorized access to internal services or sensitive data.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the textSearchV2Handler function of deno/main.tsx, where the supabase_url argument is not properly validated before use. An unauthenticated remote attacker can exploit this via query parameter manipulation to cause the backend to make requests to arbitrary URLs, potentially compromising internal systems or extracting sensitive information. A patch removing the vulnerable supabase_url query parameter has been released.
Affected products
- NonceGeek dim-sum-app
Timeline
- 2026-09-20: disclosed: Vulnerability publicly disclosed
- 2026-09-20: patched: Patch 8389032e5d52c28c4855c6126ca7d0eae8af346a removes supabase_url query parameter