Server-Side Request Forgery Vulnerability in Omnom by Asciimoo
CVE-2026-125366

5.3MEDIUM

Key Information:

Vendor

Asciimoo

Status
Omnom
Vendor
CVE Published:
9 November 2026

What is CVE-2026-125366?

The Omnom application, through version 0.9.0, is susceptible to a server-side request forgery (SSRF) vulnerability. This issue permits authenticated users to manipulate server requests by submitting arbitrary feed URLs to the /add_feed endpoint. By doing so, attackers can exploit internal network services, as functions like getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL are executed without proper validation. The absence of safeguards allows adversaries to probe internal resources through the use of reflected error messages, potentially exposing sensitive internal information.

Affected Version(s)

omnom 0 <= 0.9.0

References

https://github.com/asciimoo/omnom/issues/67
issue-tracking
https://github.com/asciimoo/omnom
product
https://github.com/asciimoo/omnom/blob/v0.9.0/feed/feed.g...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.