Read the docs
TI-2026-82255 Aliases CVE-2026-118586GHSA-pgg4-2f4g-83hg

dfm feedfinder2 find_feeds server-side request forgery

Priority LOW 36CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

CVE-2026-118586 (GHSA-pgg4-2f4g-83hg) affects dfm feedfinder2 up to 0.0.4. Manipulating the find_feeds function in feedfinder2.py leads to server-side request forgery (CWE-918), and the attack can be run remotely. The CNA rates it MEDIUM with CVSS 4.0 base score 6.9. The project received an early issue report but has not yet responded.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dfmfeedfinder20.0.1; 0.0.2; 0.0.3; 0.0.4—No fix listedCNA
  • feedfinder2 Vendordfm Affected 0.0.1; 0.0.2; 0.0.3; 0.0.4 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:dfm:feedfinder2:*:*:*:*:*:*:*:*——dfm
  • cpe:2.3:a:dfm:feedfinder2:*:*:*:*:*:*:*:* Versions — — ·dfm

Remediation

The affected ranges 0.0.1, 0.0.2, 0.0.3 and 0.0.4 have no fix listed. Until the project publishes a fix, validate or restrict the URLs passed to find_feeds, or stop using the package.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118586
  2. 2026-10-29 Alias added: GHSA-pgg4-2f4g-83hg
  3. 2026-10-30 Priority changed: MEDIUM → LOW
  4. 2026-11-03 CISA SSVC decision points changed

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences