CVE-2026-94038: Server-Side Request Forgery in NonceGeek dim-sum-app
NonceGeek dim-sum-app contains a server-side request forgery (SSRF) vulnerability in the textSearchV2Handler function within the deno/main.tsx file of its Deno Backend component. This vulnerability arises from manipulation of the supabase_url argument and can be exploited remotely. A patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is available to address this issue. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. No affected versions are explicitly stated in the available data.
AI Analysis
Technical Summary
CVE-2026-94038 is a server-side request forgery vulnerability in NonceGeek's dim-sum-app affecting the textSearchV2Handler function in deno/main.tsx. The flaw allows remote attackers to manipulate the supabase_url argument, potentially causing the server to make unauthorized requests. The vulnerability is publicly disclosed, and a patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is recommended to mitigate the issue. No explicit affected versions are provided.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery via manipulation of the supabase_url parameter. This can lead to unauthorized requests from the server, potentially exposing internal resources or sensitive data. The CVSS 4.0 score of 6.9 reflects a medium severity impact with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
A patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is available and should be applied to remediate this vulnerability. It is best practice to apply this patch promptly to prevent exploitation. No vendor advisory content was provided to indicate otherwise.
CVE-2026-94038: Server-Side Request Forgery in NonceGeek dim-sum-app
Description
NonceGeek dim-sum-app contains a server-side request forgery (SSRF) vulnerability in the textSearchV2Handler function within the deno/main.tsx file of its Deno Backend component. This vulnerability arises from manipulation of the supabase_url argument and can be exploited remotely. A patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is available to address this issue. The vulnerability has a CVSS 4.0 score of 6.9, indicating medium severity. No affected versions are explicitly stated in the available data.
CVSS v4.0
Score 6.9medium
Affected software
NonceGeek
dim-sum-app
cpe:2.3:a:noncegeek:dim-sum-app:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-94038 is a server-side request forgery vulnerability in NonceGeek's dim-sum-app affecting the textSearchV2Handler function in deno/main.tsx. The flaw allows remote attackers to manipulate the supabase_url argument, potentially causing the server to make unauthorized requests. The vulnerability is publicly disclosed, and a patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is recommended to mitigate the issue. No explicit affected versions are provided.
Potential Impact
The vulnerability enables remote attackers to perform server-side request forgery via manipulation of the supabase_url parameter. This can lead to unauthorized requests from the server, potentially exposing internal resources or sensitive data. The CVSS 4.0 score of 6.9 reflects a medium severity impact with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
A patch identified by commit 8389032e5d52c28c4855c6126ca7d0eae8af346a is available and should be applied to remediate this vulnerability. It is best practice to apply this patch promptly to prevent exploitation. No vendor advisory content was provided to indicate otherwise.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-19T20:44:16.125Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab00e1655bf5e2cf5459091
Added to database: 09/20/2026, 16:47:18 UTC
Last enriched: 09/20/2026, 17:01:30 UTC
Last updated: 09/20/2026, 17:01:30 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.