Threats tagged 'ghsa-h5cc-4jr5-gjxg'

Replicate Cog versions through 0.23.1 have a server-side request forgery (SSRF) vulnerability. This flaw allows attackers to submit prediction inputs containing attacker-controlled URLs that are not properly validated before the Cog process fetches them. Exploiting this, attackers can cause the system to make HTTP requests to internal or otherwise restricted network addresses, potentially exposing sensitive internal services or credentials.