Skip to content
OpenAdvisories

Package · npm

@karakeep/sdk

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High —
    GHSA-7rx4-c5vx-g8w3

    Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections

    ## Summary The `metascraper-logo-favicon` plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's `validateUrl()` SSRF protections. This allows any authenticated user to make the server fetch arbitrar…

    @karakeep/sdk npm