AIKIDO-2026-10695
graphifyy is vulnerable to Server-Side Request Forgery (SSRF)
82
High Risk
This Affects:
graphifyyTL;DR
validate_url resolves hostnames and rejects private, reserved, loopback, and link-local addresses ahead of fetch, while the HTTP stack resolves names again when opening the socket. An attacker-controlled DNS server can satisfy validation with a public answer and supply an internal address when the client connects, weakening metadata and localhost SSRF guards. The transcription download path passed URLs straight to yt-dlp without that validation layer. The maintenance release pins resolution checks across the whole request via _ssrf_guarded_socket, fails closed when hostname lookup fails during validation, and runs validate_url before download_audio invokes yt-dlp.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
graphifyy is vulnerable to Server-Side Request Forgery (SSRF) in versions 0.3.1 - 0.5.3.
How to fix this
Upgrade the graphifyy library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant