CVE-2026-119709

    Dashboard / Vulnerabilities / CVE-2026-119709

    CVE-2026-119709

    Published: 30 Oct 2026Last Modified: 1 Nov 2026

    Summary: Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

    Details: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119709.json, https://hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrf, https://nvd.nist.gov/vuln/detail/CVE-2026-119709, https://www.vulncheck.com/advisories/grimoire-before-1.0.0-unauthenticated-ssrf-via-api-fetch-metadata, https://github.com/goniszewski/grimoire/issues/237, https://github.com/goniszewski/grimoire, https://github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.ts, https://github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.ts

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -8bbc0f202766eabd3c95fafb8369c9b2d5c663e7

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119709 | CVE-DB