CVE-2026-85699: Jina-Ai Reader

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

jina-ai reader contains a server-side request forgery vulnerability where URL validation is performed only on the initial request but not re-applied to subsequent redirect hops. Attackers can craft a public URL that redirects to internal network addresses or cloud metadata endpoints, allowing the server to fetch and return the target's response body to the attacker.

Affected products

• Jina-Ai Reader

Published 2026-09-04. Last modified 2026-09-24.