CVE-2026-63651: LiveDocs: fetch_docs/introspect fetch client-supplied URLs with no host allowlist and follow redirects

Published Nov 10, 2026

Updated

LiveDocs is a primary-source-first documentation for AI agents. Prior to version 0.7.0, fetchdocs and introspect (kinds openapi/graphql, and resolvesource's docsurl) pass a client-supplied URL straight to URLSession with no scheme or host allowlist, and redirects are followed unconditionally. A prompt-injection payload embedded in fetched documentation can steer the model to call fetchdocs against internal or metadata endpoints and stream the response back into the conversation. This issue has been patched in version 0.7.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade LiveDocs to a version that resolves this vulnerability.
Fixed in 0.7.0

Event History

Nov 10, 2026

CVE Published

via MITRE·04:25 PM

Data Sourced

via MITRE·04:25 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

LiveDocs versions prior to 0.7.0 are affected where an attacker can cause the model or a client to invoke fetch_docs, introspect with the openapi or graphql kinds, or resolve_source with a docs_url they control.

What does an attacker need to exploit this issue?

The attacker needs a way to supply or influence a URL passed to the affected functions. A prompt-injection payload embedded in documentation fetched by LiveDocs can cause the model to request internal or metadata endpoints and return their responses in the conversation.

Do redirects or non-public destinations change exposure?

No. The affected URL handling has no scheme or host allowlist, and URLSession follows redirects unconditionally, allowing a supplied URL or redirect chain to reach internal or metadata endpoints.

How can this be remediated?

Upgrade LiveDocs to version 0.7.0, which contains the patch.

CVE-2026-63651: LiveDocs: fetch_docs/introspect fetch client-supplied URLs with no host allowlist and follow redirects

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Do redirects or non-public destinations change exposure?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Do redirects or non-public destinations change exposure?

How can this be remediated?