EUVD-2026-63190
GHSA-p53p-vh92-qhpp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible unauthenticated endpoint with no complexity; limited confidentiality and integrity impact via internal resource access; no availability impact from SSRF alone.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the component REST API Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.3.0 will fix this issue. The identifier of the patch is 96448894cc93ccecb0bdcbf263a9d25390a8455e. Upgrading the affected component is advised.
AnalysisAI
Server-Side Request Forgery in PullMD 3.2.0 exposes internal network resources and cloud metadata endpoints through the unauthenticated REST API endpoint GET /api, where the url parameter is passed without validation to the server's HTTP fetch stack. The vulnerability affects multiple fetch paths including the MCP read_url tool, Reddit resolver, and Playwright sidecar, all of which lacked SSRF guards prior to v3.3.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS 4.0 vector confirms PR:N and UI:N, meaning any network-accessible instance of PullMD 3.2.0 is exploitable without credentials or user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 5.5 with E:P (proof-of-concept) reflects a moderate-severity finding with network-accessible, unauthenticated exploitation and low impact across confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP GET request to the publicly exposed PullMD /api endpoint with url=http://169.254.169.254/latest/meta-data/iam/security-credentials/; the server resolves the hostname and fetches the cloud metadata service, returning temporary IAM credentials in the response body. A public exploit demonstrating this technique was disclosed via GitHub issue #41 at https://github.com/AeternaLabsHQ/pullmd/issues/41. |
| Remediation | Upgrade to PullMD v3.3.0 (released 2026-07-08), available at https://github.com/AeternaLabsHQ/pullmd/releases/tag/v3.3.0, which introduced the SSRF guard module lib/ssrf.js across all fetch paths. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today