CWE-918

{
  "affected": [],
  "aliases": [
    "CVE-2021-26699"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-22T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "OX App Suite before 7.10.3-rev4 and 7.10.4 before 7.10.4-rev4 allows SSRF via a shared SVG document that is mishandled by the imageconverter component when the .png extension is used.",
  "id": "GHSA-2j6h-hwqg-cgj9",
  "modified": "2022-05-24T19:08:58Z",
  "published": "2022-05-24T19:08:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26699"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2021/Jul/33"
    },
    {
      "type": "WEB",
      "url": "https://www.open-xchange.com"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/163527/OX-App-Suite-OX-Guard-OX-Documents-SSRF-Cross-Site-Scripting.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2021/Jul/33"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.18.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/oasdiff/oasdiff"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.13.2"
            },
            {
              "fixed": "1.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53508"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-73",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-07T23:45:05Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nFrom **v1.13.2** through **v1.18.0**, oasdiff did not enforce `--allow-external-refs=false` (library: `openapi3.Loader.IsExternalRefsAllowed = false`) when loading a spec from a **git revision** (the `rev:path` form, e.g. `main:openapi.yaml`). External `$ref`s were resolved on that load path even when external refs were explicitly disabled, so the mitigation silently did not apply there.\n\n## Impact\n\nA caller who set `--allow-external-refs=false` *specifically to safely process untrusted specs* remained exposed \u2014 on the git-revision load path only \u2014 to:\n\n- **SSRF** via `$ref: \"http://\u003cinternal-host\u003e/\u2026\"`, and\n- **Local file reads** via `$ref: \"/path\"` or `file://`.\n\nAffected callers:\n\n- **CLI:** `oasdiff diff main:openapi.yaml HEAD:openapi.yaml --allow-external-refs=false` (and `breaking` / `changelog` / `summary`, and the `git-diff-driver`) run over untrusted spec content.\n- **Go library consumers** of `github.com/oasdiff/oasdiff/load` that set `IsExternalRefsAllowed = false` and load from a git-revision source via `load.NewSpecInfo`.\n\nThe file and URL load paths correctly enforced the setting; only the git-revision path was affected. Callers that left external refs at the default (`true`) are not in scope for *this* advisory.\n\n## Patches\n\n**v1.18.1** enforces the external-refs policy on the git-revision path (so `--allow-external-refs=false` now blocks external `$ref`s there) and returns a dedicated exit code (`123`) when an external `$ref` is refused.\n\n## Workarounds\n\n- Upgrade to **v1.18.1**, or\n- Avoid the git-revision input form when processing untrusted specs with external refs disabled.\n\n## Notes\n\n- Introduced in **v1.13.2** (#832, which added `$ref`-chain resolution on the git-revision path); fixed in **v1.18.1** (#974, #975).\n- The permissive **default** (`allow-external-refs: true`) and its zero-interaction exposure in CI via the GitHub Action is tracked separately in GHSA-fhj3-7267-7vv5 (oasdiff-action).",
  "id": "GHSA-2jcc-mxv7-p3f9",
  "modified": "2026-07-07T23:45:05Z",
  "published": "2026-07-07T23:45:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oasdiff/oasdiff/security/advisories/GHSA-2jcc-mxv7-p3f9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oasdiff/oasdiff/pull/832"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oasdiff/oasdiff/pull/974"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oasdiff/oasdiff/pull/975"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oasdiff/oasdiff"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-54087"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-02T20:15:32Z",
    "severity": "LOW"
  },
  "details": "CVE-2025-54087 is a server-side request forgery\nvulnerability in Secure Access prior to version 14.10. Attackers with\nadministrative privileges can publish a crafted test HTTP request originating\nfrom the Secure Access server. The attack complexity is high, there are no\nattack requirements, and user interaction is required. There is no direct\nimpact to confidentiality, integrity, or availability. There is a low severity\nsubsequent system impact to integrity.",
  "id": "GHSA-2jp4-jvhp-7r63",
  "modified": "2025-10-16T18:30:22Z",
  "published": "2025-10-02T21:31:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54087"
    },
    {
      "type": "WEB",
      "url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2025-54087"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-63744"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-20T12:19:43Z",
    "severity": "MODERATE"
  },
  "details": "SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to blocked internal addresses, bypassing network access controls.",
  "id": "GHSA-2jqm-x3hr-jjmq",
  "modified": "2026-07-20T12:33:09Z",
  "published": "2026-07-20T12:33:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h5rg-8p7f-47g2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63744"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-ssrf-via-jwks-url-redirect"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.26"
            },
            {
              "fixed": "1.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pydantic-ai-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.26"
            },
            {
              "fixed": "1.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25580"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-06T18:32:39Z",
    "nvd_published_at": "2026-02-06T21:16:17Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI\u0027s URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials.\n\n**This vulnerability only affects applications that accept message history from external users**, such as those using:\n- **`Agent.to_web`** or **`clai web`** to serve a chat interface\n- **`VercelAIAdapter`** for Vercel AI SDK integration\n- **`AGUIAdapter`** or **`Agent.to_ag_ui`** for AG-UI protocol integration\n- Custom APIs that accept message history from user input\n\nApplications that only use hardcoded or developer-controlled URLs are not affected.\n\n### Description\n\nThe `download_item()` helper function downloads content from URLs without validating that the target is a public internet address. When user-supplied message history contains URLs, attackers can:\n\n1. **Access internal services**: Request `http://127.0.0.1`, `localhost`, or private IP ranges (`10.x.x.x`, `172.16.x.x`, `192.168.x.x`)\n2. **Steal cloud credentials**: Access cloud metadata endpoints (AWS IMDSv1 at `169.254.169.254`, GCP, Azure, Alibaba Cloud)\n3. **Scan internal networks**: Enumerate internal hosts and ports\n\n### Who Is Affected\n\nYou are affected if your application:\n\n1. **Uses `Agent.to_web` or `clai web`** - The web interface accepts file attachments via the Vercel AI Data Stream Protocol, where users can provide arbitrary URLs through chat messages.\n\n2. **Uses `VercelAIAdapter`** - Chat interfaces built with Vercel AI SDK allow users to submit messages containing URLs that are processed server-side.\n\n3. **Uses `AGUIAdapter` or `Agent.to_ag_ui`** - The AG-UI protocol allows users to provide file references with URLs as part of agent interactions.\n\n4. **Exposes a custom API accepting message history** - Any endpoint that accepts message history or `ImageUrl`, `AudioUrl`, `VideoUrl`, `DocumentUrl` objects from user input.\n\n### Attack Scenario\n\nVia chat interface, an attacker submits a message with a file attachment pointing to an internal resource:\n```json\n{\n  \"role\": \"user\",\n  \"parts\": [\n    {\"type\": \"file\", \"mediaType\": \"image/png\", \"url\": \"http://169.254.169.254/latest/meta-data/iam/security-credentials/\"}\n  ]\n}\n```\n\n### Affected Model Integrations\n\nMultiple model integrations download URL content in certain conditions:\n\n| Provider | Downloaded Types |\n|----------|------------------|\n| `OpenAIChatModel` | `AudioUrl`, `DocumentUrl` |\n| `AnthropicModel` | `DocumentUrl` (`text/plain`) |\n| `GoogleModel` (GLA) | All URL types (except YouTube and Files API URLs) |\n| `XaiModel` | `DocumentUrl` |\n| `BedrockConverseModel` | `ImageUrl`, `DocumentUrl`, `VideoUrl` (non-S3 URLs) |\n| `OpenRouterModel` | `AudioUrl` |\n\n## Remediation\n\n### Upgrade to Patched Version\n\n**Upgrade** to the patched version or later. The fix adds comprehensive SSRF protection:\n\n- Blocks private/internal IP addresses by default\n- Always blocks cloud metadata endpoints (even with `allow-local`)\n- Only allows `http://` and `https://` protocols\n- Resolves hostnames before requests to prevent DNS rebinding\n- Validates each redirect target\n\n### New `force_download=\u0027allow-local\u0027` Option\n\nIf an application legitimately needs to access local/private network resources (e.g., in a fully trusted internal environment), it can explicitly opt in:\n\n```python\nfrom pydantic_ai import ImageUrl\n\n# Default behavior: private IPs are blocked\nImageUrl(url=\"http://internal-service/image.png\")  # Raises ValueError\n\n# Opt-in to allow local access (use with caution)\nImageUrl(url=\"http://internal-service/image.png\", force_download=\u0027allow-local\u0027)\n```\n\n**Important**: Cloud metadata endpoints (`169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`) are **always blocked**, even with `allow-local`.\n\n### Workaround for Older Versions\n\nIf a project cannot upgrade immediately, use a [history processor](https://ai.pydantic.dev/message-history/#processing-message-history) to filter out URLs targeting local/private addresses:\n\n```python\nimport ipaddress\nimport socket\nfrom urllib.parse import urlparse\n\nfrom pydantic_ai import Agent, ModelMessage, ModelRequest\nfrom pydantic_ai.messages import AudioUrl, DocumentUrl, ImageUrl, VideoUrl\n\ndef is_private_url(url: str) -\u003e bool:\n    \"\"\"Check if a URL targets a private/internal IP address.\"\"\"\n    try:\n        parsed = urlparse(url)\n        hostname = parsed.hostname\n        if not hostname:\n            return True  # Invalid URL, block it\n\n        # Resolve hostname to IP\n        ip_str = socket.gethostbyname(hostname)\n        ip = ipaddress.ip_address(ip_str)\n\n        # Block private, loopback, and link-local addresses\n        return ip.is_private or ip.is_loopback or ip.is_link_local\n    except (socket.gaierror, ValueError):\n        return True  # DNS resolution failed, block it\n\ndef filter_private_urls(messages: list[ModelMessage]) -\u003e list[ModelMessage]:\n    \"\"\"Remove URL parts that target private/internal addresses.\"\"\"\n    url_types = (ImageUrl, AudioUrl, VideoUrl, DocumentUrl)\n    filtered = []\n    for msg in messages:\n        if isinstance(msg, ModelRequest):\n            safe_parts = [\n                part for part in msg.parts\n                if not (isinstance(part, url_types) and is_private_url(part.url))\n            ]\n            if safe_parts:\n                filtered.append(ModelRequest(parts=safe_parts))\n        else:\n            filtered.append(msg)\n    return filtered\n\n# Apply the filter to your agent\nagent = Agent(\u0027openai:gpt-5\u0027, history_processors=[filter_private_urls])\n```\n\n## Technical Details of the Fix\n\nThe fix introduces a new `_ssrf.py` module with comprehensive protection:\n\n1. **Protocol validation**: Only `http://` and `https://` allowed\n2. **DNS resolution before request**: Prevents DNS rebinding attacks\n3. **Private IP blocking** (by default):\n   - `127.0.0.0/8`, `::1/128` (loopback)\n   - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (private)\n   - `169.254.0.0/16`, `fe80::/10` (link-local)\n   - `100.64.0.0/10` (CGNAT)\n   - `fc00::/7` (unique local)\n   - `2002::/16` (6to4, can embed private IPv4)\n4. **Cloud metadata always blocked**: `169.254.169.254`, `fd00:ec2::254`, `100.100.100.200`\n5. **Safe redirect handling**: Each redirect validated before following (max 10)",
  "id": "GHSA-2jrp-274c-jhv3",
  "modified": "2026-02-06T21:42:27Z",
  "published": "2026-02-06T18:32:39Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-2jrp-274c-jhv3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pydantic/pydantic-ai/commit/d398bc9d39aecca6530fa7486a410d5cce936301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pydantic/pydantic-ai"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-20343"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-02T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 194593.",
  "id": "GHSA-2m3m-f775-94xc",
  "modified": "2022-05-24T19:03:50Z",
  "published": "2022-05-24T19:03:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20343"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/194593"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/6457739"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-20002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-20T07:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and conduct an SSRF attack through an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to a user of the web application. A successful exploit could allow the attacker to send arbitrary network requests that are sourced from the affected system.",
  "id": "GHSA-2m96-fxj3-h8fg",
  "modified": "2023-01-26T21:30:31Z",
  "published": "2023-01-20T09:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20002"
    },
    {
      "type": "WEB",
      "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-roomos-dkjGFgRK"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-47008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-08T17:15:54Z",
    "severity": "HIGH"
  },
  "details": "Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information.",
  "id": "GHSA-2mfj-g9qp-83p8",
  "modified": "2024-10-08T18:33:13Z",
  "published": "2024-10-08T18:33:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47008"
    },
    {
      "type": "WEB",
      "url": "https://forums.ivanti.com/s/article/Ivanti-Avalanche-6-4-5-Security-Advisory"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-31216"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-19T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "Siren Investigate before 11.1.1 contains a server side request forgery (SSRF) defect in the built-in image proxy route (which is enabled by default). An attacker with access to the Investigate installation can specify an arbitrary URL in the parameters of the image proxy route and fetch external URLs as the Investigate process on the host.",
  "id": "GHSA-2mjf-pm92-fg8h",
  "modified": "2022-05-24T19:08:23Z",
  "published": "2022-05-24T19:08:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31216"
    },
    {
      "type": "WEB",
      "url": "https://community.siren.io/c/announcements"
    },
    {
      "type": "WEB",
      "url": "https://docs.siren.io/siren-platform-user-guide/11.1/release-notes.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-3530"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-26T21:17:09Z",
    "severity": "MODERATE"
  },
  "details": "Server-Side Request Forgery (SSRF) vulnerability in Drupal OpenID Connect / OAuth client allows Server Side Request Forgery.This issue affects OpenID Connect / OAuth client: from 0.0.0 before 1.5.0.",
  "id": "GHSA-2mq5-fr5w-rr29",
  "modified": "2026-03-30T15:31:51Z",
  "published": "2026-03-26T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3530"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}