auto-favicon up to commit f189116a9259950c2393f114dbcb94dde0ad864b contains a server-side request forgery (SSRF) vulnerability in the generate_favicon_from_url function. This vulnerability allows remote attackers to manipulate the image_url argument to cause the server to make unintended requests. The vulnerability is tracked as CVE-2026-7150 and has a CVSS score of 6.3 (medium severity). The project uses a rolling release system, and no fixed version information has been disclosed. The issue was reported but remains unaddressed, and public exploit code is available.