MegaParse version 0.0.55 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the POST /v1/url endpoint. The endpoint fetches caller-supplied URLs server-side without any authentication checks. Attackers can exploit this by supplying internal service URLs or cloud metadata endpoints to read sensitive responses. The vulnerability is accessible without any authentication, significantly lowering the barrier to exploitation. Internal network services and cloud provider metadata endpoints (such as AWS IMDSv1) are potential targets. The responses from these internal requests are returned directly in the JSON API response, making data exfiltration straightforward. This affects users running MegaParse 0.0.55 in environments with internal network services. The issue has been documented in the project's GitHub repository and tracked by VulnCheck.
