CVE-2026-34981: CWE-918: Server-Side Request Forgery (SSRF) in pavelzbornik whisperX-FastAPI
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
AI Analysis
Technical Summary
The vulnerability exists in whisperX-FastAPI versions 0.3.1 through 0.5.x in the FileService.download_from_url() method. This method calls requests.get(url) without prior validation of the URL, allowing SSRF attacks. The file extension check intended to restrict downloads is applied only after the HTTP request is made, and can be bypassed by appending .mp3 to internal URLs. The /speech-to-text-url API endpoint is unauthenticated, enabling unauthenticated attackers to exploit this SSRF. The issue is resolved in version 0.6.0.
Potential Impact
An attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or external resources that it otherwise could not access. This can lead to unauthorized information disclosure of internal services or network resources. The CVSS score of 5.8 (medium severity) reflects the potential for limited confidentiality impact without integrity or availability effects. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in whisperX-FastAPI version 0.6.0. Users should upgrade to version 0.6.0 or later to remediate this issue. Since the vulnerability is unauthenticated and the fix is available, upgrading is the recommended and effective mitigation. Patch status is confirmed by the vendor's versioning information.
CVE-2026-34981: CWE-918: Server-Side Request Forgery (SSRF) in pavelzbornik whisperX-FastAPI
Description
The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. The file extension check occurs AFTER the HTTP request is already made, and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated. This vulnerability is fixed in 0.6.0.
CVSS v3.1
Score 5.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability exists in whisperX-FastAPI versions 0.3.1 through 0.5.x in the FileService.download_from_url() method. This method calls requests.get(url) without prior validation of the URL, allowing SSRF attacks. The file extension check intended to restrict downloads is applied only after the HTTP request is made, and can be bypassed by appending .mp3 to internal URLs. The /speech-to-text-url API endpoint is unauthenticated, enabling unauthenticated attackers to exploit this SSRF. The issue is resolved in version 0.6.0.
Potential Impact
An attacker can exploit this SSRF vulnerability to make the server perform HTTP requests to internal or external resources that it otherwise could not access. This can lead to unauthorized information disclosure of internal services or network resources. The CVSS score of 5.8 (medium severity) reflects the potential for limited confidentiality impact without integrity or availability effects. No known exploits in the wild have been reported.
Mitigation Recommendations
This vulnerability is fixed in whisperX-FastAPI version 0.6.0. Users should upgrade to version 0.6.0 or later to remediate this issue. Since the vulnerability is unauthenticated and the fix is available, upgrading is the recommended and effective mitigation. Patch status is confirmed by the vendor's versioning information.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-31T19:38:31.617Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d3dfa80a160ebd92c701e4
Added to database: 04/06/2026, 16:30:32 UTC
Last enriched: 04/06/2026, 16:47:15 UTC
Last updated: 07/10/2026, 19:47:31 UTC
Views: 228
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.