CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

• CWE-918

• https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825
• https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch
• https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825

Published

Jul 23, 2026

Last Modified

Jul 28, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63308Helm through 4.2.3, fixed in commit ba6c9a2, contains a deni…6.5
• CVE-2026-63309SurrealDB before 3.1.5 fail to apply field-level SELECT perm…4.3
• CVE-2026-6331HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where…7.5
• CVE-2026-63310NLTK before 3.9.3 fails to verify file integrity after downl…6.5
• CVE-2026-63311NLTK before 3.10.0 (affected versions <= 3.9.4) contains a s…5.3
• CVE-2026-63312NLTK before 3.10.0 contains an arbitrary local file read vul…7.5
• CVE-2026-63317Arbitrary Class Instantiation via XML Feature Generator Desc…5.6
• CVE-2026-6332CWE-312: Cleartext Storage of Sensitive Information vulnerab…7.5
• CVE-2026-63328Trivy is a security scanner. Prior to 0.72.0, plugin manifes…6.8
• CVE-2026-6333Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…5
• CVE-2026-63335The RabbitMQ Java client library allows Java and JVM-based a…6.3
• CVE-2026-63336The RabbitMQ Java client library allows Java and JVM-based a…5.1