| Package | Affected versions | Patched versions |
|---|---|---|
| prompts.chat | < 2026-03-25 | 2026-03-25 |
prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status polling feature that allows authenticated users to perform arbitrary outbound requests by supplying attacker-controlled URLs in the token parameter. Attackers can exploit the lack of URL validation to disclose the FAL_API_KEY in the Authorization header, enabling credential theft, internal network probing, and abuse of the victim's Fal.ai account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free