CVE-2026-108850 Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup
Unauthenticated attackers can trigger server-side requests via ReportLab markup injection in the PDF generation endpoint, leaking internal data and probing network reachability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108850?
CVE-2026-108850 is a medium-severity server-side request forgery vulnerability in guy-hartstein company-research-agent, published on 11 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecting unescaped ReportLab paragraph markup into the /generate-pdf endpoint. Attackers can embed inline img elements in report_content to make the server fetch internal or external hosts, leaking image responses in returned PDFs and probing reachability.
Weakness: CWE-918
Which versions are affected by CVE-2026-108850?
How do I fix CVE-2026-108850?
No fix has been published for CVE-2026-108850 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-108850 being exploited?
There is no known exploitation of CVE-2026-108850 in the wild and no public exploit code.
Sources
Also known as GHSA-5j4m-qx6m-86qc.