Security vulnerabilities and automated fixes for worker threads issues
1 post found
A critical SSRF vulnerability was discovered in `fetch-worker.js` where URLs from `sources.txt` were fetched without any validation, allowing attackers to target internal services and cloud metadata endpoints. The fix implements a robust URL allowlist that enforces HTTPS and blocks requests to private IP ranges, localhost, and link-local addresses.