MegaParse 0.0.55 contains an unauthenticated server‑side request forgery vulnerability in the POST /v1/url endpoint. The flaw allows an attacker to submit arbitrary URLs, which the server retrieves and returns in the JSON response. Because the endpoint does not enforce authentication or validate the target address, a remote attacker can use it to read internal services, metadata endpoints, or any network resource accessible from the host. This exposes potentially sensitive internal data and may facilitate lateral movement or further exploitation. The weakness maps to CWE‑918, which describes this type of SSRF vulnerability.

The vulnerability exists in MegaParse version 0.0.55, supplied by The‑Vibe‑Company. No other product or vendor versions are mentioned. Systems running this version and exposing the unprotected POST /v1/url endpoint are impacted.

The CVSS score of 8.7 indicates a high‑severity flaw. EPSS data is not available, so the exact exploitation probability cannot be quantified, but the vulnerability is unauthenticated and exploitable by anyone who can send a request to the endpoint. The vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploits, yet the possibility of internal data exposure remains significant. Attackers would simply perform an HTTP POST to the target endpoint with a crafted URL parameter, leveraging the server’s outbound request capability to retrieve sensitive content.