Server-side Request Forgery (SSRF)

Overview @karakeep/sdk is a Typescript SDK for Karakeep Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the metascraper-logo-favicon process. An attacker can cause the server to make unauthorized HTTP requests to internal or sensitive network resources by...

GHSA-7RX4-C5VX-G8W3 Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

Summary The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's validateUrl SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containin...