CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in the _is_safe_url function of Swarms through version 6.8.1, allowing attackers to bypass hostname validation and access internal services by supplying malicious URLs. This can lead to unauthorized access and potential credential exfiltration from private or loopback addresses. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses to reach internal services and exfiltrate credentials.