5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33081

CVE-2026-33081: PinchTab has Blind SSRF via browser-side redirect bypass in /download URL validation

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below have a Blind SSRF vulnerability in the /download endpoint. The validateDownloadURL() function only checks the initial user-supplied URL, but the embedded Chromium browser can follow attacker-controlled redirects/navigations to internal network addresses after validation. Exploitation requires security.allowDownload=true (disabled by default), limiting real-world impact. An attacker-controlled page can use JavaScript redirects or resource requests to make the browser reach internal services from the PinchTab host, resulting in a blind Server-Side Request Forgery (SSRF) condition against internal-only services. The issue has been patched in version 0.8.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33081

CVE-2026-33081:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/pinchtab/pinchtab	go	<= 0.8.2	0.8.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, a blind SSRF, exists in the /download endpoint because of a failure to validate all browser-initiated requests after an initial check. The provided description explicitly mentions that validateDownloadURL() is used for the first user-supplied URL, but any subsequent navigation, like a JavaScript-based redirect, bypasses this validation. This allows an attacker to host a page that, once loaded by PinchTab's Chromium browser, redirects to internal services.

The patch for this vulnerability was not clearly identifiable in the commit history between versions 0.8.2 and 0.8.3, likely because the changes were merged from a private fork. Therefore, the analysis is based on the detailed vulnerability description provided.

The identified vulnerable functions are conceptual but represent the key components of the flawed logic:

downloadHandler: The server-side function that orchestrates the download process. It's the main vulnerable component as it fails to enforce continuous validation.
newBrowserContext: The function that sets up the browser instance. It's vulnerable by omission, as it doesn't configure the browser to intercept and block malicious redirects.
validateDownloadURL: This function is part of the vulnerable process. While not flawed itself, its limited application to only the initial URL is the central issue.

An exploit would trigger the downloadHandler, which would call validateDownloadURL on the attacker's URL. The browser, configured by newBrowserContext, would then load the page and execute a JavaScript redirect to an internal IP, which would not be validated.

Vulnerable functions

downloadHandler

internal/server/handlers.go

This function, the HTTP handler for the `/download` endpoint, is the entry point for the vulnerability. It validates the initial URL but fails to configure the headless browser instance to prevent subsequent malicious navigations (e.g., via JavaScript redirects) to internal network addresses. The actual function name is inferred due to the lack of a visible patch, but it represents the server-side logic processing the download request.

newBrowserContext

internal/engine/chrome.go

This function is responsible for creating and configuring the new browser instance (tab or context) used to perform the download. It is considered vulnerable because, prior to the patch, it did not install the necessary request interceptors or handlers to validate every subsequent URL requested by the browser page, thereby allowing the SSRF. The actual function name is inferred.

validateDownloadURL

internal/server/validation.go

This function itself is not inherently flawed; it correctly validates the initial URL. However, it is a key component of the vulnerable flow. A runtime profile during exploitation would likely show this function being called for the initial, legitimate-looking URL, but it would not be called for the subsequent malicious redirect, which is the core of the vulnerability. The actual function name is taken from the vulnerability description.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.