If you found a vulnerability that you deem too sensitive to disclose publicly in a Github issue, please create a private security advisory here: https://github.com/Athou/commafeed/security/advisories
Security: Athou/commafeed
Security
SECURITY.md
-
`block-local-addresses` SSRF control misses IPv6 ULA (`fc00::/7`) and RFC6598 CGNAT (`100.64.0.0/10`): even with the control enabled, the server can reach internal services on those rangesGHSA-hgrr-mjfp-gmr6 published
Jul 5, 2026 by AthouModerate -
XML Entity Expansion (Billion Laughs) DoS via OPML import allows any authenticated user to crash the serverGHSA-83jp-rww3-57rr published
Jun 13, 2026 by AthouModerate
Learn more about advisories related to Athou/commafeed in the GitHub Advisory Database