EUVD-2026-112558
GHSA-pgg4-2f4g-83hg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify app endpoint passing URL to find_feeds
-
ExploitSubmit URL targeting internal/metadata host
-
Executionfeedfinder2 issues server-side request
-
ImpactInternal resource contacted or data disclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an application using feedfinder2 (<= 0.0.4) call find_feeds() with a URL value an attacker can influence; because find_feeds() fetches the supplied URL server-side to discover feeds, an attacker-controlled URL is the concrete prerequisite. There are no authentication prerequisites at the library level (PR:N, UI:N) and the behavior is the library's default - it fetches whatever URL it is given. The practical limiting factor is integration context: if the host application never passes untrusted URLs to find_feeds(), the SSRF is not reachable; impact is also bounded to low confidentiality (VC:L) with no write or denial-of-service effect, and no fixed version is available since the maintainer has not responded. |
| Impact | Signals point to a genuine but moderate-priority SSRF rather than an emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated triggering, but the impact is constrained to low confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope/subsequent-system change (SC:N/SI:N/SA:N), yielding a 6.9 (Medium) score. The vuln.today decision label is 'this_month,' i.e. routine remediation, not act_now or emergency. No EPSS probability, no CISA KEV listing, and no confirmed proof-of-concept were provided; the only 'exploit' artifact is a GitHub issue report (#16) used to notify the maintainer, which is not verified working exploit code. The PR:N rating deserves scrutiny: feedfinder2 is a library whose find_feeds() is called by a host application, so 'unauthenticated' reflects the attacker merely supplying a URL the application forwards - real exposure depends entirely on whether the integrating application accepts attacker-controlled URLs. Net: a real issue to patch on a normal cycle, not a high-CVSS-but-illusory finding, but also not under active exploitation on available evidence. |
| Exploit ScenarioDerived | An application embeds feedfinder2 and passes a user-supplied URL to find_feeds(), which then fetches that URL server-side to discover feeds. An attacker submits a URL pointing at an internal host or cloud metadata endpoint (e.g. a link-local address), causing the server to issue the request on the attacker's behalf and potentially return or react to internal-only resources. No public, verified exploit code is identified; only a maintainer notification issue exists. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 29, 2026
Server-side request forgery in the dfm feedfinder2 Python library through version 0.0.4 lets remote attackers steer the find_feeds() helper into issuing HTTP requests to arbitrary URLs from the host application's network position, with low confidentiality impact and no write or availability effect. Reachability depends entirely on integration: only applications that pass attacker-influenceable URLs into find_feeds() are exposed, and where URLs are trusted the flaw is not reachable. No public exploit code or active exploitation is confirmed, the maintainer has not responded to the upstream issue report, and no vendor-released fixed version is available; priority is this_month rather than emergency.
RemediationAI
No vendor-released patch was identified at time of analysis: the project was notified through the upstream issue report (https://github.com/dfm/feedfinder2/issues/16) and has not responded, and no fixed version exists above 0.0.4, so teams must treat input validation as the primary control. Do not pass untrusted URLs to find_feeds(); require that callers supply only operator-approved origins, and where external URLs must be handled, resolve the hostname first and reject loopback, link-local (including 169.254.169.254), RFC1918, and IPv6 unique-local ranges, re-checking the resolved address after every redirect and disabling automatic redirect following to limit DNS-rebinding style bypass; this will break legitimate feed discovery for internal or redirect-heavy sites and requires maintenance as new address ranges appear. As a compensating layer, restrict outbound egress from the application server to an allowlist of feed hosts or route feed discovery through a proxy that blocks metadata and internal endpoints - effective, but it may disrupt other outbound integrations hosted on the same worker. High-assurance deployments can vendor or fork the library and wrap the internal requests session with a transport adapter that enforces the same address policy, accepting the ongoing maintenance burden of carrying a local patch. Monitor the upstream repository and https://vuldb.com/vuln/428026 for a maintainer fix, and re-test rather than assume immutability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
feedfinder2 is a small Python utility library (dfm/feedfinder2) whose find_feeds() function takes a URL or page reference, fetches that resource server-side, and parses the response to discover associated RSS/Atom feed links. That fetch-the-supplied-URL design is the root cause of the CWE-918 server-side request forgery: the function performs an outbound request against a caller-supplied location without an allowlist, scheme restriction, or filtering of loopback, private, link-local, or cloud metadata address ranges, and it does not re-validate destinations reached through redirects. Because the library is consumed inside other applications, the security boundary is the caller's input handling rather than the library itself - the assessed vector (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:N) reflects that the behavior is default and requires no credentials or user interaction at the library level, that the exploit trigger is simply an attacker-influenced URL argument, and that the resulting impact is limited to reading responses or probing reachable endpoints, not modification or denial of service. No CPE identifiers were supplied in the source data, so affected scope is defined by package name and version rather than platform CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable library SSRF triggered by supplying a URL (AV:N/AC:L/PR:N/UI:N); impact limited to low confidentiality from internal responses (C:L), no integrity/availability effect, scope unchanged.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB