CVE-2026-85691: The-Vibe-Company Megaparse

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supplied URLs server-side. Attackers can supply internal service URLs or metadata endpoints without authentication to read their responses directly from the JSON response.

Affected products

• The-Vibe-Company Megaparse: up to and including 0.0.55

Published 2026-09-04. Last modified 2026-09-23.