CVE-2026-0612

The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external content provided by an attacker, which can be used to proxy requests through The Librarian infrastructure. The vendor has fixed the vulnerability in all versions of TheLibrarian.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://mindgard.ai/blog/thelibrarian-ios-ai-security-	Third Party Advisory
https://thelibrarian.io/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:thelibrarian:the_librarian:-:*:*:*:*:*:*:*

History

17 Jun 2026, 10:11

Type	Values Removed	Values Added
Summary		(es) El libreríario contiene una vulnerabilidad de fuga de información a través de la herramienta 'web_fetch', que puede ser utilizada para recuperar contenido externo arbitrario proporcionado por un atacante, lo que puede ser utilizado para redirigir solicitudes a través de la infraestructura de El libreríario. El proveedor ha corregido la vulnerabilidad en todas las versiones de TheLibrarian.

23 Jan 2026, 17:00

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
First Time		Thelibrarian Thelibrarian the Librarian
CPE		cpe:2.3:a:thelibrarian:the_librarian:-:::::::*
References	~~() http://mindgard.ai/blog/thelibrarian-ios-ai-security- -~~	() http://mindgard.ai/blog/thelibrarian-ios-ai-security- - Third Party Advisory
References	~~() https://thelibrarian.io/ -~~	() https://thelibrarian.io/ - Product

16 Jan 2026, 22:16

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5

16 Jan 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-16 13:16

Updated : 2026-06-17 10:11

NVD link : CVE-2026-0612

Mitre link : CVE-2026-0612

CVE.ORG link : CVE-2026-0612

JSON object : View

Products Affected

thelibrarian

the_librarian

CWE

NVD-CWE-noinfo

{"id": "CVE-2026-0612", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0612", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T21:42:18.745012Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "TheLibrarian", "product": "TheLibrarian.io", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.0"}]}]}], "published": "2026-01-16T13:16:11.677", "references": [{"url": "http://mindgard.ai/blog/thelibrarian-ios-ai-security-", "tags": ["Third Party Advisory"], "source": "cret@cert.org"}, {"url": "https://thelibrarian.io/", "tags": ["Product"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The Librarian contains a information leakage vulnerability through the `web_fetch` tool, which can be used to retrieve arbitrary external content provided by an attacker, which can be used to proxy requests through The Librarian infrastructure. The vendor has fixed the vulnerability in all versions of TheLibrarian."}, {"lang": "es", "value": "El librer\u00edario contiene una vulnerabilidad de fuga de informaci\u00f3n a trav\u00e9s de la herramienta 'web_fetch', que puede ser utilizada para recuperar contenido externo arbitrario proporcionado por un atacante, lo que puede ser utilizado para redirigir solicitudes a trav\u00e9s de la infraestructura de El librer\u00edario. El proveedor ha corregido la vulnerabilidad en todas las versiones de TheLibrarian."}], "lastModified": "2026-06-17T10:11:04.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thelibrarian:the_librarian:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE8F0743-241A-47D8-B16A-8E3B94C6ABB8"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}