CVE-2026-94038: NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 8389032e5d52c28c4855c6126ca7d0eae8af346a. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NonceGeek dim-sum-app (Deno Backend)to a version that resolves this vulnerability.Patch 8389032e5d52c28c4855c6126ca7d0eae8af346a - Compensating control
Restrict or validate server-side requests originating from textSearchV2Handler in deno/main.tsx to prevent abuse of the supabase_url argument (mitigate SSRF while patching).
Event History
Frequently Asked Questions
Who can exploit this issue?
The issue is remotely exploitable and requires no privileges or user interaction according to the provided vector. Systems exposing the affected Deno Backend functionality are the relevant exposure scope.
What input is involved in exploitation?
Exploitation involves manipulating the supabase_url argument handled by textSearchV2Handler in deno/main.tsx. Successful manipulation can cause the backend to make server-side requests.
Is public exploit information available?
Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.
What patch should be applied?
Apply patch 8389032e5d52c28c4855c6126ca7d0eae8af346a. The provided information does not identify affected or fixed release versions.