CVE-2026-119712
PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.
| CWE | CWE-918 |
| Vendor | pipeshub-ai |
| Product | pipeshub-ai |
| Published | Oct 30, 2026 |
| Last Updated | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for pipeshub-ai pipeshub-ai
Be the first to know when new medium vulnerabilities affecting pipeshub-ai pipeshub-ai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
pipeshub-ai / pipeshub-ai
0 < 0.10.0
References
github.com: https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx9q github.com: https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613 github.com: https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.py github.com: https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0 github.com: https://github.com/pipeshub-ai/pipeshub-ai vulncheck.com: https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-in-indexed-documents
Credits
hyderpwn