A vulnerability was detected in NASA earthdata-search 1.0.0. (CVE-2026-82801)

The vulnerability in NASA earthdata-search 1.0.0 affects the scaleImage function within serverless/src/scaleImage/handler.js of the scale Endpoint. It is classified as CWE-918 (Server-Side Request Forgery). An attacker can remotely manipulate this function to cause the server to make unauthorized requests, potentially exposing internal resources or causing other impacts. The vulnerability has a CVSS 3.1 base score of 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. The vendor has not provided a patch or response, and no official remediation is documented. Public exploit code exists, but no active exploitation has been confirmed.

Successful exploitation of this SSRF vulnerability can lead to unauthorized internal network requests, potentially exposing sensitive information, altering data, or causing denial of service conditions. The CVSS score reflects moderate impact on confidentiality, integrity, and availability. However, no active exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a patch is available, consider implementing network-level controls to restrict outbound requests from the affected service to mitigate potential SSRF exploitation.