Description
MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The-Vibe-Company megaparse
Default version status: unaffected
0 to ≤ 0.0.55affected
pkg:pypi/megaparseReferences
- https://github.com/The-Vibe-Company/megaparse/issues/259 ↗
- https://github.com/The-Vibe-Company/megaparse ↗
- https://github.com/The-Vibe-Company/megaparse/blob/megaparse-v0.0.55/libs/megaparse/src/megaparse/api/app.py ↗
- https://www.vulncheck.com/advisories/megaparse-0.0.55-server-side-request-forgery-via-post-v1-url ↗