CVE-2026-22664

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-22664

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22664.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-22664

Published

2026-04-03T20:27:48.247Z

Modified

2026-07-08T07:34:21.824563383Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

prompts.chat SSRF via Fal.ai Media Status Polling

Details

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack of URL validation to disclose the FALAPIKEY in the Authorization header, enabling credential theft, internal network probing, and abuse of the victim's Fal.ai account.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22664.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/f/prompts.chat

Affected ranges

Type

GIT

Repo

https://github.com/f/prompts.chat

Events

Introduced

Fixed

30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22664.json"