| Title | dfm feedfinder2 0.0.4 Server-Side Request Forgery |
|---|
| Description | feedfinder2 up to 0.0.4 is affected by server-side request forgery. The find_feeds() function re-fetches every discovered <link> and <a> href via requests.get with no destination IP guard and with redirects enabled (feedfinder2.py:41/76). An attacker who controls a page that gets processed can make the library issue server-side requests to internal hosts. Verified with an internal 127.0.0.1 fetch and a redirect. CWE-918. CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. |
|---|
| Source | ⚠️ https://github.com/dfm/feedfinder2/issues/16 |
|---|
| User | Anonymous User |
|---|
| Submission | 10/12/2026 19:37 (17 days ago) |
|---|
| Moderation | 10/28/2026 17:13 (16 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 428026 [dfm feedfinder2 up to 0.0.4 feedfinder2.py find_feeds server-side request forgery] |
|---|
| Points | 20 |
|---|