CVE-2024-41812

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery (SSRF) vulnerability in the `/get` route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network. Version 1.7.0 prevents displaying the response of forged requests, but the requests can still be sent. For complete mitigation, a firewall between txtdot and other internal network resources should be set.

• CWE-918
• CWE-918

• https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47Patch
• https://github.com/TxtDot/txtdot/commit/7c72d985f7a26ec1fd3cf628444717ca54986d2dPatch
• https://github.com/TxtDot/txtdot/security/advisories/GHSA-4gj5-xj97-j8fpExploit, Third Party Advisory
• https://github.com/TxtDot/txtdot/blob/a7fdaf80fdf45abefe83b2eb5135ba112142dc74/src/handlers/distributor.ts#L43-L47Patch
• https://github.com/TxtDot/txtdot/commit/7c72d985f7a26ec1fd3cf628444717ca54986d2dPatch
• https://github.com/TxtDot/txtdot/security/advisories/GHSA-4gj5-xj97-j8fpExploit, Third Party Advisory

Published

Jul 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-41807Rejected reason: ** REJECT ** DO NOT USE THIS CVE RECORD. Co…
• CVE-2024-41808The OpenObserve open-source observability platform provides …5.4
• CVE-2024-41809OpenObserve is an open-source observability platform. Starti…6.1
• CVE-2024-4181A command injection vulnerability exists in the RunGptLLM cl…8.8
• CVE-2024-41810Twisted is an event-based framework for internet application…6.1
• CVE-2024-41811ipl/web is a set of common web components for php projects. …3.9
• CVE-2024-41813txtdot is an HTTP proxy that parses only text, links, and pi…7.5
• CVE-2024-41815Starship is a cross-shell prompt. Starting in version 1.0.0 …7
• CVE-2024-41816Cooked is a recipe plugin for WordPress. The Cooked plugin f…5.4
• CVE-2024-41817ImageMagick is a free and open-source software suite, used f…7.8
• CVE-2024-41818fast-xml-parser is an open source, pure javascript xml parse…7.5
• CVE-2024-41819Note Mark is a web-based Markdown notes app. A stored cross-…5.4