CVE-2026-94038
Received Received - Intake

Server-Side Request Forgery in NonceGeek dim-sum-app

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: VulDB

Description
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-94038
EUVD
EUVD-2026-83754

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
noncegeek dim-sum-app *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the NonceGeek dim-sum-app. It occurs in the textSearchV2Handler function of the deno/main.tsx file. The flaw allows attackers to manipulate the supabase_url query parameter to force the server to send requests to arbitrary URLs. The server uses a high-privilege Supabase service role key when a non-default URL is provided, exposing this key in requests. This enables attackers to bypass security controls and access sensitive data or perform unauthorized actions.

Detection Guidance

To detect this SSRF vulnerability in NonceGeek dim-sum-app, check if the textSearchV2Handler function in deno/main.tsx processes a user-controlled supabase_url query parameter without validation. Inspect server logs for requests to /v2/text_search or /text_search_v2 with arbitrary supabase_url values. Look for outbound requests to unexpected external URLs from your server.

Impact Analysis

An attacker could exploit this to leak the Supabase service role key, which grants full access to the database, including bypassing row-level security. This allows unauthorized data reads, writes, or deletions across all tables. Attackers could also log in to any account without a password, including admin accounts, and take over the entire web management backend, such as managing users, deleting content, or altering system settings.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and potential data breaches. GDPR requires protecting personal data and reporting breaches within 72 hours. HIPAA mandates safeguarding protected health information. Exploiting this flaw could lead to unauthorized access to sensitive data, resulting in non-compliance, legal penalties, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Apply the patch commit 8389032e5d52c28c4855c6126ca7d0eae8af346a which removes the supabase_url parameter handling. Alternatively, remove the supabase_url query parameter from the textSearchV2Handler function and ensure only the default Supabase client is used. Validate all user inputs and restrict outbound requests to trusted domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94038. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart