mudler / LocalAI UNCLAIMED

LocalAI is the open-source AI engine. Run any model - LLMs, vision, voice, image, video - on any hardware. No GPU required.

0 0 70 Go

security: validate URLs to prevent SSRF in content fetching endpoints (#8476)

User-supplied URLs passed to GetContentURIAsBase64() and downloadFile()
were fetched without validation, allowing SSRF attacks against internal
services. Added URL validation that blocks private IPs, loopback,
link-local, and cloud metadata endpoints before fetching.

Co-authored-by: kolega.dev <faizan@kolega.ai>

Kolega.dev committed 3mo ago

780877d1d0fef17f4ec793bb22938bc37e56b81a

Parent: 08eeed6

Committed by GitHub <noreply@github.com> on 2/10/2026, 2:14:14 PM