Description
knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport error messages that reveal network reachability information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| knowns-dev | knowns | ≤ 0.33.0 | — |
References
- GitHub Security Advisory (GHSA-qx9v-m9gg-p5jg) vendor-advisory
- Embedding-model test issues request to caller-supplied apiBase and returns the transport error (v0.33.0, unfixed) technical-description
- gitLsRemoteHead runs git ls-remote against a caller-supplied URL (v0.33.0, unfixed) technical-description
- VulnCheck Advisory: knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint third-party-advisory