CVE-2026-91199 Details
Description
Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.
A server-side request forgery (SSRF) vulnerability exists in Refly versions through 1.1.0. The issue is located in the POST /v1/misc/scrape endpoint, which processes user-supplied URLs without proper validation of the scheme, host, or resolved address. This vulnerability allows authenticated attackers to manipulate the backend into making requests to loopback, private, and link-local addresses, including cloud metadata services. As a result, attackers can retrieve page titles and descriptions of internal resources. The vulnerability is confirmed to be exploitable by sending requests to local internal-only HTTP servers, which successfully return metadata from those servers.
It is recommended to validate the URL scheme and host before processing requests. Implement checks to reject URLs that resolve to private, loopback, or link-local addresses, and restrict the scheme to HTTP and HTTPS. Additionally, consider re-validating the destination after each redirect to prevent bypasses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/refly-ai/refly | [email protected] | Vendor |
| https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/apps/api/src/modules/misc/misc.controller.ts#L38-L43 | [email protected] | Source CodeVendor |
| https://github.com/refly-ai/refly/blob/77fb0ca184251bba7380cbac2dbdf7a6c9944652/packages/utils/src/scrape-weblink.ts | [email protected] | Source CodeVendor |
| https://github.com/refly-ai/refly/issues/2280 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/refly-through-1.1.0-server-side-request-forgery-via-scrape-endpoint | [email protected] | AdvisoryBundleVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Refly | <= 1.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |