CVE-2026-33081: fallo de gravedad media en pinchtab
PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.8epss 0.3%
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Productos afectados
pinchtab · pinchtabCVEs relacionadas — pinchtab
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-33623MEDIUMPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionEPSS 3.0%CVE-2026-33622MEDIUMA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionEPSS 0.5%CVE-2026-30834HIGHPinchTab: SSRF with Full Response Exfiltration via Download HandlerEPSS 0.5%CVE-2026-33621MEDIUMPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API TokenEPSS 0.3%CVE-2026-33620MEDIUMPinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary SystemsEPSS 0.3%CVE-2026-33619MEDIUMPinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlEPSS 0.3%