SSRF Vulnerability in NonceGeek dim-sum-app

CVE-2026-94038 describes a critical server-side request forgery (SSRF) vulnerability identified in the NonceGeek dim-sum-app. The flaw specifically resides in the textSearchV2Handler function located within deno/main.tsx of the Deno backend component. By supplying a malicious value to the supabase_url argument, a remote, unauthenticated attacker can force the application to perform unauthorized HTTP requests to arbitrary internal or external targets. This exposure can be leveraged to interact with internal infrastructure, query local services, or perform reconnaissance within the target network environment. The vulnerability has been publicly disclosed, and a patch (commit 8389032e5d52c28c4855c6126ca7d0eae8af346a) is available to remediate this issue.

Impact

Successful exploitation allows remote actors to bypass network perimeter controls and perform SSRF, potentially leading to unauthorized data exfiltration or access to internal resources normally unreachable from the public internet.

Recommendation

Prioritize the immediate application of the security patch provided by the vendor. Organizations should audit their web server and proxy logs for unusual outbound requests originating from the server hosting the Deno backend, specifically monitoring for anomalous calls targeting internal IP ranges or sensitive internal metadata endpoints.