Threats tagged 'ghsa-mpqf-rmwr-h7wr'

HKUDS nanobot versions before 0.3.0 have a server-side request forgery (SSRF) vulnerability in the WebFetchTool component. The vulnerability arises because the _validate_url() function does not block internal IP ranges and private addresses. This allows attackers to instruct the bot to fetch internal resources such as cloud metadata endpoints, localhost services, and RFC 1918 addresses, potentially exposing IAM credentials and internal service data.