Threats affecting pkg:github/cog

Replicate Cog versions up to 0.23.1 have a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to submit prediction inputs containing attacker-controlled URLs that are not properly validated, causing the Cog process to make unauthorized HTTP requests. Malicious URLs or HTTP redirects in cog.File and cog.Path predictor inputs can be exploited to force requests to internal network addresses, potentially exposing sensitive internal services or credentials.