A critical server-side request forgery vulnerability in the NonceGeek dim-sum-app allows unauthenticated remote attackers to exfiltrate high-privilege credentials and compromise the entire application.

The vulnerability exists in the textSearchV2Handler function within deno/main.tsx, where the supabase_url parameter is accepted from user input without validation. An unauthenticated attacker can supply a malicious URL to force the server to send requests containing the SUPABASE_SERVICE_ROLE_KEY to an external destination.

This vulnerability carries a severe business impact, as it facilitates a complete compromise of the underlying Supabase infrastructure. By exfiltrating the service role key, an attacker bypasses all Row Level Security policies, enabling unauthorized access to read, modify, or delete sensitive user data, authentication tokens, and administrative credentials. Given the CVSS score of 7.3, the potential for full system takeover and long-term persistence via valid service keys presents a critical risk to data integrity and operational security.

Immediate Action: Update the application immediately by pulling the latest code changes that incorporate the fix provided in commit 8389032e5d52c28c4855c6126ca7d0eae8af346a, and rotate all Supabase service role keys immediately.

Proactive Monitoring: Review server access logs for anomalous outgoing requests to unfamiliar domains, particularly those originating from the /v2/text_search endpoint.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to unauthorized external domains, and utilize a Web Application Firewall to block requests containing suspicious supabase_url parameters.

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the official GitHub issue tracker for the project.

The severity of this vulnerability cannot be overstated, as it provides a direct path to full administrative compromise of the application backend. Administrators must prioritize the application of the provided patch and perform an immediate rotation of all sensitive API keys. Failure to address this flaw leaves the entire data layer exposed to unauthorized external access.