kyegomez CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH kyegomez CVE published 2026-07-30

CVE-2026-67346

A server-side request forgery vulnerability exists in Swarms through version 6.8.1, fixed in commit 8b0fc9e. The _is_safe_url function fails to validate hostnames through DNS resolution, allowing attackers to bypass the blocklist by supplying user-controlled image or audio URLs that resolve to private, loopback, or metadata addresses, potentially reaching internal services and exfiltrating credentials.