The vulnerability in the jina‑ai reader allows an attacker to specify a URL that the server will request on their behalf. Only the first request is validated, so subsequent redirects to internal or cloud‑metadata endpoints are not checked. This flaw lets an attacker obtain the response body from an arbitrary internal address, potentially exposing sensitive data or enabling further exploitation. It is a high‑severity SSRF (CWE‑918) with a CVSS score of 8.7.

The flaw exists in the jina‑ai reader product. All publicly released versions of jina‑ai reader are potentially affected until a fix is applied, as the issue resides in the redirect handling logic within the service layer (see curl.ts and puppeteer.ts). No specific version information is provided, so the entire product line is considered at risk.

The CVSS score of 8.7 indicates a high impact, but the EPSS score is not available, so the current exploitation probability is uncertain. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a crafted HTTP request sent to the reader service’s public endpoint, which then follows a redirect to an internal or cloud metadata resource. Because the server includes the remote content in its response, an attacker can read internal data without authentication or remote code execution, but the exposure could be leveraged for further attacks if sensitive internal services are accessed.