EUVD-2026-83754
GHSA-wx3w-fghf-hgf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public textSearchV2 endpoint
-
DeliverySet supabase_url to attacker/internal URL
-
ExploitBackend builds Supabase client with service-role key
-
ExecutionServer sends request to attacker host
-
PersistExfiltrate service-role key / hit internal service
-
ImpactFull database compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of NonceGeek dim-sum-app's Deno backend, because textSearchV2Handler accepts a client-controlled supabase_url query parameter with no allowlist or validation. Impact severity depends on the SUPABASE_SERVICE_ROLE_KEY being configured (the standard deployment), since that key is what gets sent to the attacker-specified URL. The only real limiter is deployment scarcity: the affected code path must be reachable (the text-search v2 endpoint exposed), which it is by default in vulnerable versions prior to commit 8389032e. |
| Impact | This is a genuine but moderate-priority SSRF (CWE-918) with an important nuance the vendor score understates. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, all impacts Low, E:P) describes trivially reachable, unauthenticated, remote exploitation - which the source-code evidence confirms: textSearchV2Handler reads an attacker-supplied supabase_url query parameter and passes it straight into createClient(supabase_url, SUPABASE_SERVICE_ROLE_KEY). Beyond ordinary SSRF (reaching internal/cloud-metadata endpoints), this means the Supabase SERVICE ROLE (admin) key is transmitted to an attacker-controlled URL during queries, so realistic impact is credential exfiltration leading to full database compromise - I assess confidentiality as High rather than the vendor's Low. Signals: POC is publicly available (GitHub issue #366) and a patch exists (PR #367 / commit 8389032e), but there is NO EPSS score and NO KEV listing in the provided data, and exploitation status is 'publicly available exploit code exists' - not confirmed active exploitation. The strongly mitigating factor is prevalence: dim-sum-app is an obscure open-source Deno project with negligible production footprint, so despite easy exploitability this is a real-but-low-reach issue rather than a widespread emergency. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a request to the textSearchV2 endpoint with supabase_url pointing to a server they control (or to an internal/metadata address). The Deno backend instantiates a Supabase client against that URL using the site's SUPABASE_SERVICE_ROLE_KEY, causing the server to make requests to the attacker's endpoint and leak the admin key, and/or reach otherwise-unreachable internal services. A public proof-of-concept exists in the project's GitHub issue tracker (#366). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Server-side request forgery in NonceGeek dim-sum-app's Deno backend lets remote, unauthenticated attackers redirect outbound requests to an arbitrary host by supplying a crafted supabase_url query parameter to the textSearchV2Handler endpoint (deno/main.tsx). Because the handler builds a Supabase client from that attacker-controlled URL and passes the deployment's SUPABASE_SERVICE_ROLE_KEY as the credential, a successful attack both forces the server to issue requests to attacker-chosen destinations and discloses the service-role key to that endpoint, which in standard deployments can be leveraged for full privileged access to the backing Supabase project and, from there, potential impact on any data or services reachable with that key. The issue is confirmed with publicly available exploit code (disclosed via the project's GitHub issue tracker) but is not listed in CISA KEV, so no confirmed in-the-wild exploitation is established; the vendor has published a fix commit.
RemediationAI
Apply the vendor fix by updating to or past commit 8389032e5d52c28c4855c6126ca7d0eae8af346a (PR https://github.com/NonceGeek/dim-sum-app/pull/367), which removes support for the client-supplied supabase_url parameter and forces the handler to use the module-level client bound to the trusted SUPABASE_URL environment variable; no tagged release version was identified in the input data, so pin the commit or a later build explicitly. Until the patch can be deployed, treat the SUPABASE_SERVICE_ROLE_KEY as compromised and rotate it in Supabase, since the vulnerable code may already have transmitted it to an attacker-chosen endpoint - expect this rotation to invalidate existing privileged integrations that reuse the key. Additional compensating controls: strip or reject any supabase_url (and equivalent destination-override) query parameter at the reverse proxy or WAF in front of the Deno backend, accepting that legitimate clients that relied on the override will break; apply an egress firewall or network policy restricting the backend's outbound traffic to only the expected Supabase project hostname and any other required services, with the trade-off that legitimate third-party integrations will fail until allowlisted; and restrict public network access to the text-search v2 endpoint where feasible. Monitor Supabase and backend logs for outbound requests to unexpected hosts and for anomalous service-role API activity to detect prior exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
dim-sum-app is a small open-source application whose backend runs on Deno (deno/main.tsx) and uses the Supabase JavaScript client for data access. The vulnerable function, textSearchV2Handler, read a client-supplied supabase_url query parameter and, if it differed from the SUPABASE_URL environment variable, called createClient(supabase_url, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "") - constructing a new Supabase client pointed at the attacker's URL while still attaching the application's service-role key. This is a classic CWE-918 server-side request forgery: a user-controlled URL is passed to an outbound HTTP client with no allowlist, scheme restriction, or validation, so the server can be induced to send requests to arbitrary internal or external destinations, and the privileged credential travels with those requests. The published patch (commit 8389032e5d52c28c4855c6126ca7d0eae8af346a, PR #367) removes the query-parameter override entirely and reverts the handler to the module-level singleton client bound to the trusted SUPABASE_URL environment variable, eliminating the attacker-controlled destination. The CPE cpe:2.3:a:noncegeek:dim-sum-app:*:*:*:*:*:*:*:* indicates no version constraint was enumerated in the source data, i.e. all builds prior to the fix commit are presumed affected; the exact fix version was not defined by a tagged release in the available inputs.
Know when Dim Sum App gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated network request with no user interaction (PR:N/UI:N/AC:L); C:H because the service-role admin key is exfiltrated to the attacker, I:L for limited internal request forgery, A:N.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB