Description
The metascraper-logo-favicon plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application’s validateUrl() SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containing a crafted <link rel="icon"> tag.
Recommendation
Update the @karakeep/sdk package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.31.0
- Patched version(s): 0.32.0
References
Could your website be exposed too?
SmartScanner can check your website for Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
- Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
- PDFME has SSRF via Unvalidated URL Fetch in `getB64BasePdf` When `basePdf` Is Attacker-Controlled - Vulnerability
- MCPHub has Path Traversal via Malicious MCPB Manifest Name - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated May 14, 2026