CVE-2026-33081
- Source
- https://cve.org/CVERecord?id=CVE-2026-33081
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33081.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-33081
- Aliases
- Downstream
- Related
- Published
- 2026-03-20T09:05:01.753Z
- Modified
- 2026-04-10T05:42:36.755857Z
- Severity
-
- 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
- Summary
- PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation
- Details
-
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33081.json", "cwe_ids": [ "CWE-918" ], "cna_assigner": "GitHub_M" }- References