CVE-2026-119709— Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Quick assessment

Affected

goniszewski grimoire

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

1.0.0 之前的 Grimoire 版本在 POST 处理程序中包含一个未认证的服务器端请求伪造（SSRF）漏洞。该处理程序会将用户提供的 URL 直接传递给函数，且未进行任何身份验证检查。攻击者可提交指向回环地址、内网或云元数据端点的 URL，从而读取解析后的标题、描述和页面内容。

CVSS 5.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1602 · Data from Configuration Repository

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Source: CVE Program / CVE List V5

Vulnerability Description

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

服务端请求伪造(SSRF)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
goniszewski	grimoire	0 ~ 1.0.0	-

II. Public POCs for CVE-2026-119709

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119709

请登录查看更多情报信息。

Other References for CVE-2026-119709 (6)

https://github.com/goniszewski/grimoire/blob/v0.5.0/src/routes/api/fetch-metadata/%2Bserver.ts technical-description
https://github.com/goniszewski/grimoire/blob/v0.5.0/src/lib/utils/get-metadata.ts technical-description
https://github.com/goniszewski/grimoire product
https://hackmd.io/@hieuPenguinnn/grimoire-fetch-metadata-ssrf third-party-advisory
https://github.com/goniszewski/grimoire/issues/237 issue-tracking
https://www.vulncheck.com/advisories/grimoire-before-1.0.0-unauthenticated-ssrf-via-api-fetch-metadata third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119709

IV. Related Vulnerabilities

Same weakness: CWE-918