{"action":"Upgrade @karakeep/sdk to 0.32.0 or later.","affected":[{"fixed":"0.32.0","introduced":"0"}],"component":"@karakeep/sdk","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.32.0"],"ghsa_id":"GHSA-7rx4-c5vx-g8w3","id":"tcs_01M5KFAXB2FKK86ZQZ1Q493NS2","modified_at":"2026-05-14T18:34:54.944207Z","published_at":"2026-05-14T18:26:02Z","references":["https://osv.dev/vulnerability/GHSA-7rx4-c5vx-g8w3","https://github.com/karakeep-app/karakeep/security/advisories/GHSA-7rx4-c5vx-g8w3","https://github.com/karakeep-app/karakeep/pull/2763","https://github.com/karakeep-app/karakeep/commit/3dc321e7d49aa3a1a2493637fb2ee21616fe5fd9","https://github.com/karakeep-app/karakeep","https://github.com/karakeep-app/karakeep/releases/tag/v0.32.0"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-7rx4-c5vx-g8w3","url":"https://osv.dev/vulnerability/GHSA-7rx4-c5vx-g8w3"}],"summary":"Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections"}