CVE-2026-18647 is a server-side request forgery vulnerability in the jina-ai reader product, specifically in the isValidTLD function of the /backend/functions/src/cloud-functions/crawler.ts file within the Crawler/Puppeteer component. The vulnerability allows remote attackers to manipulate the function to cause the server to make unauthorized requests. The product uses a rolling release approach, so no discrete affected or fixed versions are provided. The vendor was contacted but did not respond, and no official remediation or patch information is available. The CVSS 4.0 base score is 6.9 with network attack vector, low complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to cause the server to perform unintended requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. The impact is rated medium based on the CVSS 4.0 score of 6.9. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor official channels for updates. Until a fix is released, consider restricting network access for the affected component to limit SSRF impact and review usage of the isValidTLD function in the crawler component to apply any possible input validation or filtering.