CVE-2021-39195

Misskey is an open source, decentralized microblogging platform. In affected versions a Server-Side Request Forgery vulnerability exists in "Upload from URL" and remote attachment handling. This could result in the disclosure of non-public information within the internal network. This has been fixed in 12.90.0. However, if you are using a proxy, you will need to take additional measures. As a workaround this exploit may be avoided by appropriately restricting access to private networks from the host where the application is running.

• CWE-918

• https://github.com/misskey-dev/misskey/blob/develop/CHANGELOG.md#12900-20210904Release Notes, Third Party Advisory
• https://github.com/misskey-dev/misskey/commit/e1a8b158e04ad567d92d8daf3cc0898ee18f1a2ePatch, Third Party Advisory
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-mqv7-gxh4-r5vfIssue Tracking, Patch, Third Party Advisory
• https://github.com/misskey-dev/misskey/blob/develop/CHANGELOG.md#12900-20210904Release Notes, Third Party Advisory
• https://github.com/misskey-dev/misskey/commit/e1a8b158e04ad567d92d8daf3cc0898ee18f1a2ePatch, Third Party Advisory
• https://github.com/misskey-dev/misskey/security/advisories/GHSA-mqv7-gxh4-r5vfIssue Tracking, Patch, Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2
• CVE-2021-39193Frontier is Substrate's Ethereum compatibility layer. Prior …5.3
• CVE-2021-39194kaml is an open source implementation of the YAML format wit…6.5
• CVE-2021-39196pcapture is an open source dumpcap web service interface . I…6.5
• CVE-2021-39197better_errors is an open source replacement for the standard…8.8
• CVE-2021-39198OroCRM is an open source Client Relationship Management (CRM…5.4
• CVE-2021-39199remark-html is an open source nodejs library which compiles …6.1
• CVE-2021-3920grav-plugin-admin is vulnerable to Improper Neutralization o…5.4
• CVE-2021-39200WordPress is a free and open-source content management syste…5.3