GHSA-7j2f-6h2r-6cqc: Koel Vulnerable to SSRF via Podcast Episode Enclosure URLs
highvulnerability
security
Summary
Koel, a podcast player, has a vulnerability where it validates the main podcast feed URL for safety but fails to validate individual episode URLs extracted from the RSS feed (the XML file that lists episodes). When a user plays an episode, the server downloads content from these unvalidated URLs, allowing an attacker to trick it into accessing internal services like AWS metadata endpoints and stealing credentials or sensitive data.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.0%
Patch Available
Yes
Disclosure Date
May 29, 2026
Classification
Attack SophisticationModerate
Affected Packages
phanan/koel@<= 9.3.4 (fixed: 9.3.5)
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-7j2f-6h2r-6cqc
First tracked: May 29, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 95%