Security vulnerabilities and automated fixes for orbis issues
1 post found
A critical Server-Side Request Forgery (SSRF) vulnerability in `src/fetch.js` allowed the `fetchPage()` function to access internal network addresses, private IP ranges, and cloud metadata endpoints without any validation. This fix hardens input validation to block requests to RFC 1918 private addresses, localhost, and cloud metadata endpoints, preventing attackers from exploiting the function to probe internal infrastructure.