GHSA-7rx4-c5vx-g8w3

## Summary The `metascraper-logo-favicon` plugin makes HTTP requests to URLs extracted from attacker-controlled HTML without going through the application's `validateUrl()` SSRF protections. This allows any authenticated user to make the server fetch arbitrary internal URLs by bookmarking a page containing a crafted `<link rel="icon">` tag. ## Details ### Protected path (correct) Karakeep implements comprehensive SSRF protections in `apps/workers/network.ts` (lines 12-222). The `validateUrl()` function blocks loopback, private, link-local, carrier-grade NAT, and reserved IP ranges. It resolves DNS before the fetch and checks all resolved IPs against the blacklist. This function is correctly used by `fetchWithProxy()` for the main bookmark URL fetch, image downloads, RSS feeds, and webhooks. ### Unprotected path (vulnerability) After fetching the page HTML (with SSRF protection), the content is passed to a parse subprocess (`apps/workers/scripts/parseHtmlSubprocess.ts`). Inside this subprocess, `metascraper-logo-favicon` (v5.49.5) extracts favicon URLs from the HTML DOM by matching `<link rel="icon">` elements and reading their `href` attribute. The plugin then calls `reachable-url` (which wraps `got`) to verify each extracted URL. These HTTP requests bypass `validateUrl()` entirely: ```typescript // apps/workers/scripts/parseHtmlSubprocess.ts, lines 62-73 metascraperLogo({ gotOpts: { agent: { http: serverConfig.proxy.httpProxy ? new HttpProxyAgent(getRandomProxy(serverConfig.proxy.httpProxy)) : undefined, https: serverConfig.proxy.httpsProxy ? new HttpsProxyAgent(getRandomProxy(serverConfig.proxy.httpsProxy)) : undefined, }, }, }), ``` Only proxy agent configuration is provided. No URL validation hooks, no IP blacklist, no DNS resolution checks. The `got` HTTP client makes direct requests to whatever URLs are extracted from the HTML. ### Data flow ``` 1. User creates bookmark →