Repository navigation
Security: MbinOrg/mbin
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Mbin downloads the icon/image/attachment URL of any remote ActivityPub actor or post it processes with a plain HTTP client that has no scheme restriction and no private, loopback, or link local address check, letting any federated (self signed, no special access needed) remote server force the Mbin instance to send arbitrary HTTP/HTTPS requests to its internal network or cloud metadata endpointGHSA-779p-4f7q-pg32 published
Oct 20, 2026 by blued-gearCritical
Learn more about advisories related to MbinOrg/mbin in the GitHub Advisory Database