CVE-2026-125366

Description

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/asciimoo/omnom/issues/67 ↗
• https://github.com/asciimoo/omnom ↗
• https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421 ↗
• https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10 ↗
• https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route ↗