AIKIDO-2026-10695

TL;DR

validate_url resolves hostnames and rejects private, reserved, loopback, and link-local addresses ahead of fetch, while the HTTP stack resolves names again when opening the socket. An attacker-controlled DNS server can satisfy validation with a public answer and supply an internal address when the client connects, weakening metadata and localhost SSRF guards. The transcription download path passed URLs straight to yt-dlp without that validation layer. The maintenance release pins resolution checks across the whole request via _ssrf_guarded_socket, fails closed when hostname lookup fails during validation, and runs validate_url before download_audio invokes yt-dlp.