Threats affecting pkg:github/chaskiq

Chaskiq versions through 2.0.3 have a server-side request forgery (SSRF) vulnerability in the /oembed endpoint. This flaw allows unauthenticated attackers to make the server fetch arbitrary URLs via the url parameter. The vulnerable service, FetchLinkCardService, follows redirects and skips TLS verification, enabling attackers to access internal resources such as loopback, private network, or cloud metadata endpoints. The vulnerability has a CVSS score of 5.8, indicating medium severity.

Chaskiq versions up to 2.0.3 have a critical server-side request forgery (SSRF) vulnerability in the createUrlUpload GraphQL mutation. This flaw allows unauthenticated attackers to submit arbitrary URLs, including internal and cloud metadata endpoints, via POST requests to /graphql. The response content can then be retrieved through the returned ActiveStorage blob URL, potentially exposing sensitive internal data.