copilot-api versions up to 0.7.0 contain a vulnerability involving reliance on reverse DNS resolution for a security-critical action in the Header Handler component. Manipulating the Host argument can trigger this issue remotely. The vulnerability has a medium severity score and public exploit details have been disclosed. The vendor has not responded to the disclosure and no patch is currently available.