Skip to content
Heist/ feed
Back to feed
High

MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

Type: advisorySources: OSV

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-85691
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 08:37 UTC · Revision 1

Source evidence

MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url

core-osv · Original source

Published 4 Sept 2026, 14:32 UTC

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

osv:CVE-2026-85691
Complete source record
{
  "id": "86b4a7abad554f710fb9fbdbb3bbbfb30df781e8069b461b0ad40050aada1a09",
  "url": "https://osv.dev/vulnerability/CVE-2026-85691",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url",
    "summary": "MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.",
    "evidence": "osv:CVE-2026-85691",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-85691",
      "aliases": [
        "CVE-2026-85691"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/the-vibe-company/megaparse",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "4a4d7f29108d399642d08f0ac75db31081a2bdb8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "0.0.55"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "megaparse-v0.0.55",
            "megaparse-sdk-v0.1.12",
            "megaparse-sdk-v0.1.11",
            "megaparse-v0.0.54",
            "megaparse-v0.0.53",
            "megaparse-sdk-v0.1.10",
            "megaparse-v0.0.52",
            "megaparse-v0.0.51",
            "megaparse-sdk-v0.1.9",
            "megaparse-v0.0.50",
            "megaparse-sdk-v0.1.8",
            "megaparse-v0.0.49",
            "megaparse-v0.0.48",
            "megaparse-sdk-v0.1.7",
            "megaparse-sdk-v0.1.6",
            "megaparse-sdk-v0.1.5",
            "megaparse-v0.0.47",
            "megaparse-v0.0.46",
            "megaparse-v0.0.45",
            "megaparse-v0.0.44",
            "megaparse-v0.0.43",
            "megaparse-v0.0.42",
            "megaparse-v0.0.41",
            "megaparse-v0.0.40",
            "megaparse-v0.0.39",
            "megaparse-v0.0.38",
            "megaparse-v0.0.37",
            "megaparse-v0.0.36",
            "megaparse-v0.0.35",
            "megaparse-v0.0.34",
            "megaparse-v0.0.33",
            "megaparse-v0.0.32",
            "megaparse-v0.0.31",
            "megaparse-v0.0.30",
            "megaparse-v0.0.29",
            "megaparse-v0.0.28",
            "megaparse-v0.0.27",
            "megaparse-v0.0.26",
            "megaparse-v0.0.25",
            "megaparse-v0.0.24",
            "megaparse-v0.0.23",
            "megaparse-v0.0.22",
            "v0.0.21",
            "v0.0.20",
            "v0.0.19",
            "v0.0.18",
            "v0.0.17",
            "v0.0.16",
            "v0.0.15",
            "v0.0.14",
            "v0.0.13",
            "v0.0.12",
            "v0.0.11",
            "v0.0.10",
            "v0.0.9",
            "v0.0.8",
            "v0.0.7",
            "v0.0.6",
            "v0.0.5",
            "v0.0.4",
            "v0.0.3",
            "v0.0.2",
            "v0.0.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85691.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:27.490882901Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85691.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-85691",
        "https://www.vulncheck.com/advisories/megaparse-0.0.55-server-side-request-forgery-via-post-v1-url",
        "https://github.com/The-Vibe-Company/megaparse/issues/259",
        "https://github.com/The-Vibe-Company/megaparse",
        "https://github.com/The-Vibe-Company/megaparse/blob/megaparse-v0.0.55/libs/megaparse/src/megaparse/api/app.py"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-918"
        ],
        "cna_assigner": "VulnCheck",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85691.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-85691",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493903,
  "published_at": "2026-09-04T14:32:35.348+00:00"
}