{"id":"CVE-2026-118586","kind":"vulnerability","aliases":["CVE-2026-118586"],"related":[],"title":"feedfinder2: find_feeds lets crafted input trigger server-side request forgery","description":"A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.","summary":"feedfinder2 up to version 0.0.4 has a flaw in its find_feeds function in feedfinder2.py that allows server-side request forgery. A remote attacker who supplies crafted input can make the server issue requests to destinations of the attacker's choosing.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["feedfinder2","package","python","self-hosted"],"not_affected_if":["no-untrusted-input"],"how_to_check":"- Check the installed version with `pip show feedfinder2` and look for anything at or below `0.0.4`\n- Search dependency manifests for `feedfinder2` to see whether it is pinned or pulled in indirectly","fix":"- No patched version is named in the sources; the project had not responded to the report at the time of publication\n- Until a fix exists, restrict or validate the URLs passed to find_feeds, or remove the dependency","status":"open","published_at":"2026-10-29T00:17:26+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","triaged_at":"2026-10-29T00:37:14+00:00","updated_at":"2026-10-29T00:37:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T00:37:14Z","model":"claude-haiku-5-5","output":{"fix":"- No patched version is named in the sources; the project had not responded to the report at the time of publication\n- Until a fix exists, restrict or validate the URLs passed to find_feeds, or remove the dependency","reach":"internet","title":"feedfinder2: find_feeds lets crafted input trigger server-side request forgery","impact":"medium","summary":"feedfinder2 up to version 0.0.4 has a flaw in its find_feeds function in feedfinder2.py that allows server-side request forgery. A remote attacker who supplies crafted input can make the server issue requests to destinations of the attacker's choosing.","category":"package","nicknames":[],"who_cares":["python","feedfinder2","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"server makes requests to internal hosts chosen by attacker","analyst_note":"Confirm the affected version range and any patch or maintainer response at the NVD entry, and check whether find_feeds fetches arbitrary URLs.","how_to_check":"- Check the installed version with `pip show feedfinder2` and look for anything at or below `0.0.4`\n- Search dependency manifests for `feedfinder2` to see whether it is pinned or pulled in indirectly","needs_analyst":true,"not_affected_if":["no-untrusted-input"],"who_is_affected":"Applications that call feedfinder2's find_feeds on URLs or content that an outside party can influence are exposed, because the flaw lets that input steer server-side requests. Services that only run feedfinder2 on trusted, hard-coded inputs are much less exposed. unknown whether any particular deployment setting changes the exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3319,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118586':15A,18A '-2026':14A,17A '0.0.4':29B,78C 'affect':81C 'allow':41B 'attack':49B,64B,104C 'choos':66B 'craft':5A,52B 'cve':13A,16A 'destin':61B 'dfm':74C 'discov':72C 'earli':114C 'exploit':101C 'feed':3A,36B,85C 'feedfinder2':1A,19B,25B,75C 'feedfinder2.py':39B,89C 'file':88C 'find':2A,35B,84C 'flaw':32B,69C 'forgeri':12A,46B,99C 'function':37B,83C 'host':24B 'inform':110C 'input':6A,53B 'issu':58B,80C,117C 'let':4A 'make':55B 'manipul':92C 'packag':20B 'perform':90C 'possibl':106C 'problem':113C 'project':108C 'python':21B 'remot':48B,100C 'report':118C 'request':11A,45B,59B,98C 'respond':122C 'result':93C 'secur':68C 'self':23B 'self-host':22B 'server':9A,43B,57B,96C 'server-sid':8A,42B,95C 'side':10A,44B,97C 'suppli':51B 'trigger':7A 'version':28B 'yet':123C","nicknames":[],"mitigations":[],"who_affected":"Applications that call feedfinder2's find_feeds on URLs or content that an outside party can influence are exposed, because the flaw lets that input steer server-side requests. Services that only run feedfinder2 on trusted, hard-coded inputs are much less exposed. unknown whether any particular deployment setting changes the exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-29T00:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118586","severity":null,"published_at":"2026-10-29T00:17:26+00:00","modified_at":"2026-10-29T00:17:26+00:00","first_seen_at":"2026-10-29T00:36:21+00:00","fetched_at":"2026-10-29T00:36:21+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}