CVE-2026-94038: dim-sum-app Deno Backend SSRF Vulnerability

CVE-2026-94038 Overview

CVE-2026-94038 is a Server-Side Request Forgery (SSRF) vulnerability affecting the NonceGeek dim-sum-app project. The flaw resides in the textSearchV2Handler function within deno/main.tsx, part of the Deno Backend component. An attacker can manipulate the supabase_url query parameter to force the server to issue outbound requests to attacker-controlled endpoints. The vulnerability is remotely exploitable without authentication or user interaction, and a public disclosure exists. The maintainers addressed the issue with commit 8389032e5d52c28c4855c6126ca7d0eae8af346a.

Critical Impact
An unauthenticated remote attacker can coerce the Deno backend into initializing a Supabase client against an attacker-supplied URL, enabling SSRF against internal services and potential leakage of the SUPABASE_SERVICE_ROLE_KEY to the attacker endpoint.

Affected Products

NonceGeek dim-sum-app
Component: Deno Backend (deno/main.tsx)
Function: textSearchV2Handler

Discovery Timeline

2026-09-20 - CVE-2026-94038 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94038

Vulnerability Analysis

The textSearchV2Handler function in deno/main.tsx accepts a user-controllable supabase_url query parameter. The handler passes this value directly to createClient() from the Supabase SDK when the supplied URL differs from the environment-configured value. Because no allowlist, scheme validation, or host restriction is applied, an attacker can point the client at any reachable host, including internal metadata services, private network hosts, or attacker-controlled collectors. This behavior matches the classic CWE-918: Server-Side Request Forgery pattern.

When the client initializes and executes a query, the attacker-supplied endpoint receives HTTP requests originating from the backend. Depending on the SDK's request construction, the attacker-controlled server can also receive the SUPABASE_SERVICE_ROLE_KEY because that secret is passed as the client's authorization header.

Root Cause

The root cause is missing input validation on the supabase_url query parameter. The handler trusts client-supplied input to select the backend URL used for a privileged Supabase client, violating the principle that connection targets for service-role clients must be server-controlled.

Attack Vector

The attack is executed over the network with low complexity and requires no privileges or user interaction. An attacker issues an HTTP request to the vulnerable text search endpoint and appends a crafted supabase_url query parameter pointing to an attacker-controlled or internal host. The Deno backend then instantiates a Supabase client against that URL and forwards the service-role credential in outbound requests.

text

// Patch diff from deno/main.tsx (removes attacker-controllable URL selection)
   // const column = queryParams.get("column");
   const limitStr = queryParams.get("limit");
   const limit = limitStr ? parseInt(limitStr, 10) : undefined;
-  const supabase_url =
-    queryParams.get("supabase_url") || Deno.env.get("SUPABASE_URL") || "";
-  // 使用模块级单例（避免每次重建连接），仅当传入了不同的 supabase_url 时才临时创建
-  const searchSupabase =
-    supabase_url === (Deno.env.get("SUPABASE_URL") ?? "")
-      ? supabase
-      : createClient(supabase_url, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY") ?? "");
   try {
     // const searchableTables = ["cantonese_corpus_all"];

Source: GitHub Commit 8389032. The fix removes the supabase_url query parameter path entirely and forces the handler to use the module-level Supabase singleton bound to the server's environment configuration.

Detection Methods for CVE-2026-94038

Indicators of Compromise

Inbound HTTP requests to the text search endpoint that include a supabase_url query parameter with a non-default host.
Outbound HTTP requests from the Deno backend to unexpected destinations, including private IP ranges, cloud metadata endpoints such as 169.254.169.254, or unfamiliar external hosts.
Access log entries where supabase_url references a scheme or host that does not match the configured SUPABASE_URL environment value.

Detection Strategies

Parse application access logs for requests containing the supabase_url query parameter and alert when the value diverges from the sanctioned Supabase project URL.
Instrument the Deno runtime or a reverse proxy to record outbound network destinations and flag connections initiated from the backend to non-Supabase hosts.
Add a static-analysis rule for Deno and TypeScript codebases that flags any invocation of createClient() where the URL argument is derived from queryParams.get() or other request-scoped input.

Monitoring Recommendations

Enable egress logging on the host or container running the Deno backend and alert on connections to internal RFC1918 ranges or cloud metadata services.
Monitor for anomalous spikes in requests to the textSearchV2Handler endpoint from a single source, which may indicate SSRF probing.
Track secret usage by rotating SUPABASE_SERVICE_ROLE_KEY and monitoring authentication logs in Supabase for calls originating from unexpected IP addresses.

How to Mitigate CVE-2026-94038

Immediate Actions Required

Update dim-sum-app to the revision containing commit 8389032e5d52c28c4855c6126ca7d0eae8af346a or later.
Rotate the SUPABASE_SERVICE_ROLE_KEY and any other secrets that may have been transmitted to attacker-controlled endpoints during the exposure window.
Review Deno backend egress logs for requests to unexpected external or internal hosts since the deployment of the vulnerable code.

Patch Information

The upstream fix is documented in GitHub Pull Request #367 and merged as commit 8389032e5d52c28c4855c6126ca7d0eae8af346a. The associated report is tracked in GitHub Issue #366 and the VulDB CVE-2026-94038 record. The patch removes the supabase_url query parameter path and forces the handler to use the environment-configured Supabase client.

Workarounds

Deploy a reverse proxy or WAF rule that strips or rejects any request containing a supabase_url query parameter before it reaches the Deno backend.
Restrict outbound network access from the Deno backend using egress firewall rules that only allow traffic to the sanctioned Supabase project host.
If immediate patching is not possible, temporarily disable the affected search endpoint until the fix can be deployed.

bash

# Example NGINX rule to drop requests containing the supabase_url parameter
if ($arg_supabase_url) {
    return 400;
}