{"data":{"id":"32575609-fc59-4641-a5dd-bf519d63c46c","title":"CVE-2026-27170: OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. In versions…","summary":"OpenSift, an AI study tool for semantic search over large datasets, has a server-side request flaw in its URL ingest feature in versions 1.1.2-alpha and below. The overly permissive fetch behavior can be coerced into requesting unsafe targets, letting an attacker probe private and local network resources from the OpenSift host process when ingesting attacker-controlled URLs.","solution":"Fixed in version 1.1.3-alpha. As a workaround for trusted local-only exceptions, set OPENSIFT_ALLOW_PRIVATE_URLS=true, used with caution.","labels":["security","industry"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-27170","publishedAt":"2026-02-21T00:16:16.980Z","cveId":"CVE-2026-27170","cweIds":["CWE-20","CWE-918"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["OpenSift"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"OpenSift server-side request forgery through URL ingest","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00206,"epssCheckedAt":"2026-11-04T06:10:13.820Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T18:11:06.173Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}