CVE-2026-118586: dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function findfeeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the PyPI feedfinder2 package through version 0.0.4 are affected where untrusted input can influence calls to find_feeds in feedfinder2.py. Remote exploitation is possible without stated authentication or user interaction requirements.
What can an attacker do with this issue?
An attacker can manipulate the affected function to cause server-side request forgery, making the application issue requests from its own environment. The provided data rates confidentiality impact as low and does not identify integrity or availability impact.
Is a fix available?
The data does not identify a patched version or vendor remediation. It states that the project was notified through an issue report but had not responded.
How can I determine whether my application is affected?
Check whether your application uses feedfinder2 version 0.0.4 or earlier and invokes find_feeds from feedfinder2.py with attacker-controlled or otherwise untrusted input. The supplied data does not provide a more specific detection method or exploit indicator.