jina-ai reader vulnerabilities

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply publicly resolvable hostnames mapping to private addresses to retrieve cloud metadata and internal service content.

A security vulnerability in jina-ai reader up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1 affects the function isValidTLD in /backend/functions/src/cloud-functions/crawler.ts of the Crawler/Puppeteer component. The manipulation leads to server-side request forgery (SSRF). Remote exploitation is possible and the exploit has been publicly disclosed.