CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2026-33081
Low (3.7) in pinchtab pinchtab. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/pinchtab/pinchtab 0.8.3.
PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 22% of CVEs (scores of 2026-10-31)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pinchtab:pinchtab
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qwxp-6qf9-wr4m | Go | github.com/pinchtab/pinchtab | <0.8.3 | 0.8.3 |
| GO-2026-4748 | Go | github.com/pinchtab/pinchtab | <0.8.3 | 0.8.3 |