jina-ai Reader CVE-2026-18647

The jina-ai Reader service must be network-accessible by the attacker. No authentication is required (CVSS 4.0 PR:N). The triggering condition is any user-supplied URL or domain input routed through the isValidTLD function in the Crawler/Puppeteer cloud function - this is the service's core crawl functionality, not an edge-case configuration. The practical impact is bounded by the network reachability of the Puppeteer process: if the host has no access to internal networks or cloud metadata endpoints, confidentiality and integrity impact is reduced to external resource abuse. All known deployments up to commit 1574bfd are affected with no safe downgrade target due to the rolling release model. Exploitation is not limited by user interaction, authentication, or non-default configuration - the crawler's intended public API surface is the attack vector.

The CVSS 4.0 base score of 5.5 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects unauthenticated, low-complexity remote exploitation. The supplemental E:P metric confirms a PoC exists, elevating realistic exploitability above a theoretical rating. All three impact metrics are rated Low (VC:L/VI:L/VA:L), which typically understates SSRF risk: even partial internal resource access can expose cloud IAM credentials via metadata services or enable internal service enumeration, making real-world impact highly environment-dependent. The product is not listed in CISA KEV, and no EPSS data was provided, so widespread automated exploitation is unconfirmed but cannot be excluded given the public PoC. The vendor's non-response to disclosure means no official remediation exists, compounding risk for all current deployments. This is a genuine priority for any deployment of jina-ai Reader with internal network access or cloud-hosted infrastructure.

An unauthenticated attacker submits a crafted URL targeting an internal address - such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ - to the jina-ai Reader crawling endpoint. The isValidTLD validation function fails to reject the non-public domain, and the Puppeteer headless browser fetches the cloud metadata endpoint on the attacker's behalf, returning IAM credentials or internal service responses. A public proof-of-concept demonstrating this technique is available at https://github.com/orionyan520/cve_report/issues/8, substantially lowering the skill bar for exploitation.