CVE-2026-27170

Katalog CVE

CVSS 7.1 · High EPSS 0,32%

Kerentanan Improper Input Validation pada opensift. Skor CVSS 3.1 7.1 (High) menurut github.com.

Deskripsi (NVD)

OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions 1.1.2-alpha and below, URL ingest allows overly permissive server-side fetch behavior and can be coerced into requesting unsafe targets. Potential access/probing of private/local network resources from the OpenSift host process when ingesting attacker-controlled URLs. This issue has been fixed in version 1.1.3-alpha. To workaround when using trusted local-only exceptions, use OPENSIFT_ALLOW_PRIVATE_URLS=true with caution.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenSift/OpenSift/security/advisories/GHSA-3w2r-hj5p-h6pp advisory vendor
• https://github.com/OpenSift/OpenSift/releases/tag/v1.1.3-alpha product · release notes