CVE-2026-18647 is a server-side request forgery vulnerability in the jina-ai reader product affecting the isValidTLD function in the /backend/functions/src/cloud-functions/crawler.ts file of the Crawler/Puppeteer component. The vulnerability allows remote attackers to manipulate the server into making unauthorized requests. The product uses a rolling release model, so no specific affected or fixed versions are provided. The vendor was contacted but did not respond, and no official remediation or patch is currently available. The CVSS 4.0 score is 6.9, reflecting medium severity. Public exploit details have been disclosed, but no active exploitation has been confirmed.

The vulnerability enables remote attackers to perform server-side request forgery, potentially allowing the attacker to make unauthorized requests from the server. This can lead to information disclosure or interaction with internal systems not otherwise accessible. The medium CVSS score indicates a significant but not critical risk. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor vendor channels for updates. Until a patch is released, consider restricting outbound requests from the affected component or implementing network-level controls to limit SSRF impact.