{"id":"CVE-2026-119709","published":"2026-10-30T16:17:53.910","lastModified":"2026-10-30T19:23:25.493","description":"Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.","cvssScore":5.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","cwes":["CWE-918"],"vendors":[],"products":[],"references":[{"url":"https://github.com/goniszewski/grimoire","tags":[]},{"url":"https://github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.ts","tags":[]},{"url":"https://github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.ts","tags":[]},{"url":"https://github.com/goniszewski/grimoire/issues/237","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrf","tags":[]},{"url":"https://www.vulncheck.com/advisories/grimoire-before-1.0.0-unauthenticated-ssrf-via-api-fetch-metadata","tags":[]}],"exploitRefs":[{"url":"https://github.com/goniszewski/grimoire","tags":[]},{"url":"https://github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.ts","tags":[]},{"url":"https://github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.ts","tags":[]},{"url":"https://github.com/goniszewski/grimoire/issues/237","tags":[]}],"hasPoc":true,"ai":null}