Medium severity5.8NVD Advisory· Published Oct 30, 2026
CVE-2026-119709
CVE-2026-119709
Description
Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.
Patches
Vulnerability mechanics
References
5- github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.tsnvd
- github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.tsnvd
- github.com/goniszewski/grimoire/issues/237nvd
- hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrfnvd
- www.vulncheck.com/advisories/grimoire-before-1.0.0-unauthenticated-ssrf-via-api-fetch-metadatanvd
News mentions
0No linked articles in our index yet.