CVE-2026-85691highCWE-918

CVE-2026-85691: falha de alta gravidade em The-Vibe-Company megaparse

MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

Publicada em 04 set 2026 · Atualizada em 10 set 2026

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.6%

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

The-Vibe-Company · megaparse

Referências

https://github.com/The-Vibe-Company/megaparse https://github.com/The-Vibe-Company/megaparse/blob/megaparse-v0.0.55/libs/megaparse/src/megaparse/api/app.py https://github.com/The-Vibe-Company/megaparse/issues/259 https://www.vulncheck.com/advisories/megaparse-0.0.55-server-side-request-forgery-via-post-v1-url