PT-2026-38645 · Prompthub · Prompthub

Shmulc8 · Published 2026-05-08 · Updated 2026-05-12 · CVE-2026-42261

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PromptHub versions 0.4.9 through 0.5.3

Description An authenticated endpoint "/api/skills/fetch-remote" fetches a user-supplied URL server-side and reflects the response body back to the caller. The Server-Side Request Forgery (SSRF) protection in the isPrivateIPv6 function attempts to block private or loopback destinations, but it can be bypassed using alternate IPv6 representations. This allows access to any IPv4 address (including loopback, RFC1918, and link-local) via IPv4-mapped IPv6 in hex form, as well as the canonical ::1 address. Any authenticated user with a user or admin role can trigger this issue. In deployments where ALLOW REGISTRATION is set to true, any registered internet user can exploit this behavior.

Recommendations Update to version 0.5.4.

Exploit

Fix

Protection Mechanism Failure

RCE

SSRF

Weakness Enumeration

CWE-693

CWE-20

CWE-918

Related Identifiers

CVE-2026-42261

Affected Products

Prompthub

References · 8

• 🔥 https://github.com/legeling/PromptHub/security/advisories/GHSA-9fhh-fjfg-5mr6 · Exploit
• https://github.com/legeling/PromptHub/releases/tag/v0.5.4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-42261 · Security Note
• https://t.me/CVEtracker/53055 · Telegram Post
• https://twitter.com/CVEarity/status/2052801038722482441 · Twitter Post
• https://t.me/cveNotify/162741 · Telegram Post
• https://t.me/cveNotify/163213 · Telegram Post
• https://twitter.com/CVEnew/status/2053559128950227285 · Twitter Post