CVE-2026-33081

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.

• CWE-918

• https://github.com/pinchtab/pinchtab/releases/tag/v0.8.3Product, Release Notes
• https://github.com/pinchtab/pinchtab/security/advisories/GHSA-qwxp-6qf9-wr4mExploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33076Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33077Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…7.5
• CVE-2026-33078Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33079In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReD…8.7
• CVE-2026-3308An integer overflow vulnerability in 'pdf-image.c' in Artife…7.8
• CVE-2026-33080Filament is a collection of full-stack components for accele…5.4
• CVE-2026-33082DataEase is an open source data visualization analysis tool.…9.8
• CVE-2026-33083DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33084DataEase is an open-source data visualization and analytics …8.8
• CVE-2026-33088Movable Type provided by Six Apart Ltd. contains an SQL Inje…9.8
• CVE-2026-3309The Paid Membership Plugin, Ecommerce, User Registration For…6.5
• CVE-2026-33092Local privilege escalation due to improper handling of envir…7.8