| Package | Affected versions | Patched versions |
|---|---|---|
| prompts.chat | < 2026-03-24 | 2026-03-24 |
prompts.chat prior to commit 1464475 contains a blind server-side request forgery vulnerability in the Wiro media generator that allows authenticated users to perform server-side fetches of user-controlled inputImageUrl parameters. Attackers can exploit this vulnerability by sending POST requests to the /api/media-generate endpoint to probe internal networks, access internal services, and exfiltrate data through the upstream Wiro service without receiving direct response bodies.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free