CVE-2026-22662 in prompts.chat
Summary
prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Responsible
VulnCheck
Reservation
01/08/2026
Disclosure
04/04/2026
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 355197 | prompts.chat Wiro Service server-side request forgery | 918 | Not defined | Official fix | CVE-2026-22662 |