jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.

A server-side request forgery (SSRF) vulnerability exists in jina-ai/reader where URL validation is only applied to the initial request and not to subsequent HTTP redirect hops. Attackers can exploit this by crafting a publicly accessible URL that redirects to internal network addresses or cloud metadata endpoints such as AWS IMDSv1. The server fetches and returns the response body of the redirected target to the attacker, potentially exposing sensitive internal data. The vulnerable code paths are identified in curl.ts and puppeteer.ts within the reader service. This bypass allows attackers to enumerate and access internal infrastructure that would otherwise be protected by the initial URL validation logic. The issue has been reported and tracked in the project's GitHub issue tracker. An advisory has also been published by VulnCheck detailing the attack vector and impact. This vulnerability poses a high risk especially in cloud-hosted deployments where metadata endpoints are accessible.