CVE-2026-119712

    Dashboard / Vulnerabilities / CVE-2026-119712

    CVE-2026-119712

    Published: 30 Oct 2026Last Modified: 7 Nov 2026

    Summary: PipesHub before 0.10.0 SSRF via Image URLs in Indexed Documents

    Details: PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119712.json, https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0, https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-mp2g-r37c-fx9q, https://nvd.nist.gov/vuln/detail/CVE-2026-119712, https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-ssrf-via-image-urls-in-indexed-documents, https://github.com/pipeshub-ai/pipeshub-ai/commit/16b05ed7c4c492330046fa10753389a5a5886613, https://github.com/pipeshub-ai/pipeshub-ai, https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/python/app/modules/parsers/image_parser/image_parser.py

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -b04bf6aa5a2cf15f3e4ec04146e492053aedd632

    Affected versions

    v0.9.1
    v0.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119712 | CVE-DB