A server-side request forgery (SSRF) vulnerability has been identified in jina-ai reader up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. The vulnerability exists in the isValidTLD function within the Crawler/Puppeteer component, specifically in the file /backend/functions/src/cloud-functions/crawler.ts. Remote attackers can exploit this flaw to perform SSRF attacks. A public exploit has been disclosed and may be actively used. The product uses a rolling release model, so no specific version numbers are provided for affected or patched releases. The vendor was notified prior to public disclosure but did not respond. This vulnerability poses a significant risk as SSRF can be used to pivot attacks into internal networks or cloud metadata services.