Threats affecting pkg:github/github.com/go-viper/mapstructure/v2

Miniflux versions 2.3.0 through 2.3.3 have a server-side request forgery (SSRF) vulnerability that allows authenticated users to set a feed's proxy_url to internal or loopback addresses. This bypasses network restrictions intended to prevent access to private networks, enabling potential probing of internal ports and proxy-style requests to internal services. The vulnerability has a medium severity with a CVSS score of 4.3.

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

Miniflux v2 before version 2.3.1 contains an open redirect vulnerability due to improper handling of redirect URLs with backslashes. This allows an unauthenticated attacker to bypass relative-path and host checks in the login flow and redirect users to attacker-controlled external sites. The issue is fixed in version 2.3.1.

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.

Miniflux 2 is an open source feed reader. Prior to version 2.2.16, Miniflux's media proxy endpoint (`GET /proxy/{encodedDigest}/{encodedURL}`) can be abused to perform Server-Side Request Forgery (SSRF). An authenticated user can cause Miniflux to generate a signed proxy URL for attacker-chosen media URLs embedded in feed entry content, including internal addresses (e.g., localhost, private RFC1918 ranges, or link-local metadata endpoints). Requesting the resulting `/proxy/...` URL makes Miniflux fetch and return the internal response. Version 2.2.16 fixes the issue.

Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows after login. Protocol-relative URLs like //ikotaslabs.com have an empty scheme and pass that check, allowing post-login redirects to attacker-controlled sites. This issue is fixed in version 2.2.15.