Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M
CVE-2026-30834PinchTab: SSRF with Full Response Exfiltration via Download Handler
High 7.5
In plain English
A high-severity server-side request forgery in pinchtab from pinchtab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/pinchtab/pinchtab | 0.7.7 | GO-2026-4631 |
| Go | github.com/pinchtab/pinchtab/cmd/pinchtab | 0.7.7 | GHSA-rw8p-c6hf-q3pg |
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/pinchtab/pinchtab/security/advisories/GHSA-rw8p-c6hf-q3pg x_refsource_CONFIRM