CVE-2026-33081: falha de média gravidade em pinchtab
PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.8epss 0.3%
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
pinchtab · pinchtabCVEs relacionadas — pinchtab
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33623MEDIUMPinchTab: OS Command Injection via Profile Name in Windows Cleanup Routine Enables Arbitrary Command ExecutionEPSS 3.0%CVE-2026-33622MEDIUMA PinchTab Security Policy Bypass in /wait Allows Arbitrary JavaScript ExecutionEPSS 0.5%CVE-2026-30834HIGHPinchTab: SSRF with Full Response Exfiltration via Download HandlerEPSS 0.5%CVE-2026-33621MEDIUMPinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API TokenEPSS 0.3%CVE-2026-33620MEDIUMPinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary SystemsEPSS 0.3%CVE-2026-33619MEDIUMPinchTab has Unauthenticated Blind SSRF in Task Scheduler via Unvalidated callbackUrlEPSS 0.3%