Heym versions 0.0.90 and earlier contain two SSRF egress gaps. The first is in the LLM image-edit input loader (_load_image_bytes), which fetched HTTP/HTTPS URLs using a bare httpx.get call with only a scheme check, allowing user-controlled URLs to bypass egress restrictions and access loopback, RFC1918, and cloud metadata endpoints. The second gap is in the _is_public_address function, which failed to properly unwrap IPv6 transition addresses such as NAT64, deprecated IPv4-compatible, and 6to4 addresses, allowing these to bypass IP validation and egress pinning. Version 0.0.91 remediates these issues by routing image loading through guarded HTTP clients, correctly evaluating embedded IPv4 addresses in IPv6 transition forms, and outright refusing certain IPv6 prefixes associated with tunneling protocols.

An attacker able to control the image URL input in workflows can cause the server to make unauthorized HTTP requests to internal network resources, including loopback, private RFC1918 addresses, and cloud metadata endpoints. This could lead to information disclosure or further internal network attacks. The CVSS score is 5.0 (medium severity) with low attack complexity and partial confidentiality impact.

A fix is available in Heym version 0.0.91, which addresses both SSRF egress gaps by improving URL validation and IP address checks. Users should upgrade to version 0.0.91 or later to remediate these vulnerabilities.