Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostname…

Swarms versions through 6.8.1 contain a server-side request forgery (SSRF) vulnerability in the _is_safe_url function. The function fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses. This enables attackers to reach internal services and potentially exfiltrate credentials. The vulnerability was fixed in commit 8b0fc9e. The flaw is classified as a DNS rebinding bypass technique. It poses a high risk due to potential credential exfiltration and access to internal infrastructure. Users should update to the patched version immediately.