{"data":{"id":"c2ee6e5a-7930-4372-9cf9-28bbedb499a2","title":"CVE-2026-33621: PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab `v0.7.7`…","summary":"PinchTab v0.7.7 through v0.8.4 has incomplete request throttling on auth-checkable endpoints. In v0.7.7 through v0.8.3, RateLimitMiddleware in internal/handlers/middleware.go was never added to the production handler chain, and the pre-v0.8.4 limiter keyed clients by X-Forwarded-For, allowing header spoofing if enabled. v0.8.4 fixed both but still exempted /health and /metrics from rate limiting.","solution":"Fixed in v0.8.5: RateLimitMiddleware is applied in the production handler chain, the client address is derived from the immediate peer IP instead of forwarded headers by default, and the /health and /metrics exemption is removed.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33621","publishedAt":"2026-03-26T21:17:06.597Z","cveId":"CVE-2026-33621","cweIds":["CWE-290","CWE-770"],"cvssScore":"4.8","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["github.com/pinchtab/pinchtab@>= 0.7.7, < 0.8.5 (fixed: 0.8.5)"],"affectedPackageNames":["github.com/pinchtab/pinchtab"],"affectedPackageRefs":["go:github.com/pinchtab/pinchtab"],"affectedVendors":[],"affectedVendorsRaw":["PinchTab"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"PinchTab rate limiting missing on auth-checkable endpoints","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","attackVector":"network","attackComplexity":"high","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.0032,"epssCheckedAt":"2026-11-10T00:11:23.085Z","kevDateAdded":null,"advisoryAliases":["GHSA-j65m-hv65-r264"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:50:14.192Z","patchAvailable":true,"disclosureDate":"2026-03-26T21:17:06.597Z","fixReleasedAt":"2026-03-20T15:47:43.000Z","daysToFix":-6,"fixCheckedAt":"2026-10-29T21:39:30.438Z","capecIds":["CAPEC-130"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"github.com/pinchtab/pinchtab","fixedVersion":"0.8.5","matchedVersion":"v0.8.5","fixReleasedAt":"2026-03-20T15:47:43.000Z","daysToFix":-6,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:39:30.293Z"}]}}