CVE-2026-18647

HIGH 7.3

jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-918
Vendor	jina-ai
Product	reader
Published	Aug 3, 2026

Stay Ahead of the Next One

Get instant alerts for jina-ai reader

Be the first to know when new high vulnerabilities affecting jina-ai reader are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

jina-ai / reader

1574bfd380d249c86c82db4dace0d9c8fe17e2b1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/385566 vuldb.com: https://vuldb.com/vuln/385566/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18647 vuldb.com: https://vuldb.com/submit/855011 github.com: https://github.com/orionyan520/cve_report/issues/8

Credits

🔍 orionyan (VulDB User) VulDB CNA Team