AIKIDO-2026-10078
camel-ai is vulnerable to Server-Side Request Forgery
68
Medium Risk
This Affects:
camel-aiTL;DR
Affected versions of this package are vulnerable to accepting unsafe remote WebSocket links in the hybrid_browser_toolkit WebSocket server, which could be abused to connect to arbitrary remote hosts; this patch tightens validation of the base URL in the WebSocket server to only allow localhost or 127.0.0.1, preventing remote links and mitigating potential server-side request forgery or unauthorized access via manipulated WebSocket connections.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
camel-ai is vulnerable to Server-Side Request Forgery in versions 0.2.73 - 0.2.82.
How to fix this
Upgrade the camel-ai library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant