Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostname…

Swarms versions through 6.8.1 contain a server-side request forgery (SSRF) vulnerability in the _is_safe_url function. The function fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist. Attackers can supply user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses. This enables attackers to reach internal services and potentially exfiltrate credentials. The vulnerability was fixed in commit 8b0fc9e. The issue is tracked as CVE-2026-67346 and is documented in GitHub issue #1714 and pull request #1734. The attack vector leverages DNS rebinding techniques to circumvent URL safety checks. Users should update to a version incorporating commit 8b0fc9e or later.