Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77066— Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query

Quick assessment

Affected
omnivore-app omnivore
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中的 会将用户提供的 URL 直接传递给 ，而未进行任何地址验证。同一文件中的订阅路径已通过 进行保护，该函数通过 库拒绝私有和保留地址范围，且 也应用了相同的检查，因此此遗漏仅特定于该解析器。经过身份验证的用户可以指示服务器请求任意内部端点。响应被解析为数据源（feed）或 HTML，解析器返回生成的 url、title、description 和 type 字段，因此信息泄露仅限于具有数据源结构的元数据以及用于宣传 RSS 或 Atom 数据源的 link 元素；无法解析的请求仍可通过产生的错误区分可达端口与不

CVSS 5.0 · Medium EPSS 0.20% · P10

Affected Version Matrix 1

VendorProduct Version RangeStatus
omnivore-app omnivore < c4d7d8562e6b9aabb1d8e4dabca268e314baa43a affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-77066

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query
Source: CVE Program / CVE List V5
Vulnerability Description
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
omnivore-app omnivore 0 ~ c4d7d8562e6b9aabb1d8e4dabca268e314baa43a -

II. Public POCs for CVE-2026-77066

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77066

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77066 (2)

Vendor Advisories for CVE-2026-77066 (1)

Proof of Concept for CVE-2026-77066 (1)

Other References for CVE-2026-77066 (1)

IV. Related Vulnerabilities

Same product: omnivore
Same vendor: omnivore-app
Same weakness: CWE-918

V. Comments for CVE-2026-77066

No comments yet

Leave a comment