AIKIDO-2025-10914

TL;DR

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs in file handling code; the old code would accept any URL and attempt to fetch it, allowing an attacker to specify internal, loopback, or cloud metadata service addresses, but the patch mitigates this by validating that the hostname is a valid alphanumeric domain and not an IP address, thereby blocking attempts to exploit the server's trust relationship to probe internal networks or access sensitive data.