p PatchFirst

PatchFirst · Latest vulnerabilities

@karakeep/sdk vulnerabilities

Vulnerabilities published for @karakeep/sdk in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-7rx4-c5vx-g8w3

    High · CVSS 7.1Fix available

    Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

    ## Summary The `metascraper-logo-favicon` plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's `validateUrl()` SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containing a crafted `<link rel="icon">` tag. ## Details ### Protected path (correct) Karakeep implements comprehensive SSRF protections in `apps/workers/network.ts` (lines 12-222). The `validateUrl()` function blocks loopback, private, link-local, carrier-grade NAT, and reserved IP ranges. It resolves DNS before the fetch and checks all resolved

    @karakeep/sdkNode.js
    • Update to 0.32.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →