Description
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
kyegomez swarms
Default version status: unaffected
0 to ≤ 6.8.1affected8b0fc9e4645603ad94d5fcf4da86e3b9c71f4743unaffected
pkg:github/kyegomez/swarms