PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Pinchtab |
|
No data.
No data.
References
History
Mon, 09 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Pinchtab
Pinchtab pinchtab |
|
| Vendors & Products |
Pinchtab
Pinchtab pinchtab |
Sat, 07 Mar 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint allows any user with API access to induce the PinchTab server to make requests to arbitrary URLs, including internal network services and local system files, and exfiltrate the full response content. This issue has been patched in version 0.7.7. | |
| Title | PinchTab: SSRF with Full Response Exfiltration via Download Handler | |
| Weaknesses | CWE-918 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-03-07T15:36:30.036Z
Updated: 2026-03-07T15:36:30.036Z
Reserved: 2026-03-05T21:06:44.606Z
Link: CVE-2026-30834
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-07T16:15:56.057
Modified: 2026-03-09T13:35:07.393
Link: CVE-2026-30834
Redhat
No data.