grimoire vulnerabilities

CVEs whose affected-version data names the grimoire package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119709Medium· 5.8

1w ago

Grimoire before 1.0.0 Unauthenticated SSRF via /api/fetch-metadata

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs …

▾ Sunlitgoniszewski · grimoireEPSS 0.41%via CVEORG