CVE-2026-63313

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

• CWE-918

• https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825
• https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch
• https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825

Published

Jul 23, 2026

Last Modified

Jul 24, 2026

Status

Received

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63305AVideo through 29.0 contains an OS command injection vulnera…9.2
• CVE-2026-63306stoatchat before 0.13.5 contains an unauthenticated server-s…9.2
• CVE-2026-63307Chat2DB before 5.3.0 contains an insecure direct object refe…7.1
• CVE-2026-63308Helm through 4.2.3, fixed in commit ba6c9a2, contains a deni…5.3
• CVE-2026-63309SurrealDB before 3.1.5 fail to apply field-level SELECT perm…4.3
• CVE-2026-6331HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where…7.5
• CVE-2026-63317Arbitrary Class Instantiation via XML Feature Generator Desc…5.6
• CVE-2026-6332CWE-312: Cleartext Storage of Sensitive Information vulnerab…7.5
• CVE-2026-6333Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…5
• CVE-2026-6334Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…3.8
• CVE-2026-6335GitLab has remediated an issue in GitLab CE/EE affecting all…5.4
• CVE-2026-63358FileGator accepts arbitrary Unix permission values via the '…8.4