{"data":{"id":"91778ea0-656b-4820-a392-5dbe329df587","title":"CVE-2026-30834: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7…","summary":"PinchTab, a standalone HTTP server that gives AI agents direct control over a Chrome browser, contains a Server-Side Request Forgery (SSRF) flaw in its /download endpoint in versions prior to 0.7.7 (CWE-918). Any user with API access can make the server request arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content.","solution":"This issue has been patched in version 0.7.7.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-30834","publishedAt":"2026-03-07T16:15:56.057Z","cveId":"CVE-2026-30834","cweIds":["CWE-918"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/pinchtab/pinchtab/cmd/pinchtab@<= 0.7.6 (fixed: 0.7.7)"],"affectedPackageNames":["github.com/pinchtab/pinchtab/cmd/pinchtab"],"affectedPackageRefs":["go:github.com/pinchtab/pinchtab/cmd/pinchtab"],"affectedVendors":[],"affectedVendorsRaw":["PinchTab"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PinchTab server-side request forgery in /download endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00467,"epssCheckedAt":"2026-11-04T12:08:34.339Z","kevDateAdded":null,"advisoryAliases":["GHSA-rw8p-c6hf-q3pg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:32.268Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:40:03.797Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/pinchtab/pinchtab/cmd/pinchtab","fixedVersion":"0.7.7","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-10-29T21:40:03.548Z"}]}}