AIKIDO-2026-10048

TL;DR

Affected versions of this package are vulnerable to server-side request forgery (SSRF) because the GraphQL asset upload resolver made unvalidated HTTP requests to user-controlled URLs, allowing an attacker to force the server to fetch arbitrary external resources. In the referenced commit, the implementation was hardened by disabling automatic redirects and tightening how the HTTP client is constructed for asset fetches, preventing attackers from leveraging open redirects or crafted URLs to coerce the server into contacting internal or arbitrary endpoints.