reader vulnerabilities

3 known vulnerabilities in reader from Jina-ai. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  reader: Server-Side Request Forgery

  CVE-2026-85699Sep 4, 2026Jina-ai

  jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or c

• 7.5 High severity

  reader: Server-Side Request Forgery

  CVE-2026-82638Aug 30, 2026Jina-ai

  jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud met

• 7.3 High severity

  reader: Server-Side Request Forgery

  CVE-2026-18647Aug 3, 2026Jina-ai

  A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipu