SSRF Vulnerability in Jina AI Reader Crawler

A server-side request forgery (SSRF) vulnerability (CVE-2026-18647) has been identified in the Jina AI Reader component, specifically within the 'isValidTLD' function located in '/backend/functions/src/cloud-functions/crawler.ts'. The flaw exists in the Crawler/Puppeteer module and allows a remote attacker to manipulate the crawler's input, resulting in the ability to force the server to make arbitrary requests to internal or external resources. The vulnerability affects all versions of Jina AI Reader up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. Because Jina AI Reader utilizes a rolling release model, users are encouraged to update their deployment to the latest available build to mitigate the risk. Public exploit code for this vulnerability has been disclosed, increasing the likelihood of opportunistic exploitation in the wild.

Impact

Successful exploitation of CVE-2026-18647 allows an attacker to bypass network perimeter controls by leveraging the server as a proxy. This can lead to the exfiltration of internal service metadata, unauthorized interaction with internal APIs, or port scanning of internal network segments that are not otherwise accessible from the internet. The vulnerability poses a high risk to organizations hosting Jina AI Reader in cloud environments where the service may have elevated network privileges.

Recommendation

• Update Jina AI Reader to the latest version to include the patch for the 'isValidTLD' function.
• Review cloud environment egress policies for the server hosting the Jina AI Reader component to restrict connectivity to internal-only endpoints (e.g., 169.254.169.254, internal RFC1918 subnets).
• Inspect web server access logs for anomalous requests directed at the crawler endpoint that contain unexpected or internal IP addresses in query parameters.