EleutherAI Language Model Evaluation Harness server-side request forgery vulnerability

The EleutherAI Language Model Evaluation Harness contains a server-side request forgery vulnerability. This vulnerability arises because the lm-evaluation-harness component fails to validate model URLs specified in JobSpecs. Authenticated users can submit malicious model URLs, resulting in the...