jina‑ai reader, when not deployed on Google Cloud, turns off a private‑address guard that normally blocks requests to internal IP ranges. This allows an unauthenticated attacker to supply any publicly resolvable hostname that maps to a private address, causing the reader to perform an HTTP request to that address. The attacker can thus read cloud‑metadata endpoints or other internal services, exposing credentials, configuration, and potentially sensitive data. The flaw satisfies the definition of an SSRF vulnerability (CWE‑918).

All instances of the jina‑ai reader application that are not running within Google Cloud deployments are vulnerable. The specific affected versions are not listed, so any installation of jina‑ai reader in an external environment inherits the risk.

The CVSS score of 8.7 indicates a high severity impact, and the lack of an EPSS value means the current exploitation probability is unknown but potentially significant. The vulnerability is currently not listed in the CISA KEV catalog, which suggests it is not yet widely exploited, yet the ease of triggering an SSRF by simply sending a crafted hostname makes it a straightforward attack vector. If the reader retains outbound network permissions, an attacker can readily connect to internal services, retrieve sensitive data, and use that information for further attacks.