Download Latest Version v0.40.4 source code.zip (63.0 MB) Google Add to Preferred Sources
Home / v0.40.2
Name Modified Size InfoDownloads / Week
Parent folder
README.md 2026-07-03 632 Bytes
v0.40.2 source code.tar.gz 2026-07-03 3.8 MB
v0.40.2 source code.zip 2026-07-03 4.3 MB
Totals: 3 Items   8.1 MB 0
  • Security (SSRF): the /bookmark and /import endpoints fetched a caller-supplied URL with no restriction on the target, letting an unauthenticated caller make the server request internal-only hosts (loopback, private ranges, and the link-local cloud-metadata endpoint) and, via bookmark, read the response back. Outbound fetches are now blocked from reaching non-public addresses, validated at DNS-resolution time so redirects and DNS-rebinding are covered too. Set ATOMIC_ALLOW_PRIVATE_FETCH=1 to opt out (e.g. for intentional LAN fetches). Reported by Ray Sabee / Whitehat Security (whitehatsecurity.nl).
Source: README.md, updated 2026-07-03