| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| README.md | 2026-07-03 | 632 Bytes | |
| v0.40.2 source code.tar.gz | 2026-07-03 | 3.8 MB | |
| v0.40.2 source code.zip | 2026-07-03 | 4.3 MB | |
| Totals: 3 Items | 8.1 MB | 0 | |
- Security (SSRF): the
/bookmarkand/importendpoints fetched a caller-supplied URL with no restriction on the target, letting an unauthenticated caller make the server request internal-only hosts (loopback, private ranges, and the link-local cloud-metadata endpoint) and, via bookmark, read the response back. Outbound fetches are now blocked from reaching non-public addresses, validated at DNS-resolution time so redirects and DNS-rebinding are covered too. SetATOMIC_ALLOW_PRIVATE_FETCH=1to opt out (e.g. for intentional LAN fetches). Reported by Ray Sabee / Whitehat Security (whitehatsecurity.nl).