CVE-2026-70479

Summary

The flaw allows an authenticated user to use JavaScript to access blocked internal addresses, potentially exposing sensitive data in web-search or RAG output.

Exploitability

Exploitation requires an authenticated user with access to the affected feature and knowledge of internal addresses. The risk is moderate due to the need for authentication.

Blast radius

If exploited, the impact is limited to the data exposed in web-search or RAG output, but could still be significant if sensitive information is involved.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.11.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.