CVE-2026-94038CWE-918ssrf

CVE-2026-94038

High · published September 20, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
42.7
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00511 · 42.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-09-20T21:16Z
References (8)
https://github.com/NonceGeek/dim-sum-app/ · [email protected]https://github.com/NonceGeek/dim-sum-app/commit/8389032e5d52c28c4855c6126ca7d0eae8af346a · [email protected]https://github.com/NonceGeek/dim-sum-app/issues/366 · [email protected]https://github.com/NonceGeek/dim-sum-app/pull/367 · [email protected]https://vuldb.com/cve/CVE-2026-94038 · [email protected]https://vuldb.com/submit/947732 · [email protected]https://vuldb.com/vuln/407967 · [email protected]https://vuldb.com/vuln/407967/cti · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 20 SEP 16:30Z
    NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
    cvelistv5