CVE-2026-125366

EUVD-2026-120529
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 13%
Common Weakness Enumeration
References
https://github.com/asciimoo/omnom
https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.go#L421
https://github.com/asciimoo/omnom/commit/01c45510ab06c51bc952901514735b457a492f10
https://github.com/asciimoo/omnom/issues/67
https://www.vulncheck.com/advisories/omnom-through-0.9.0-ssrf-via-add-feed-add-feed-route