Shepherd EUVD-2026-96907

Exploitation requires the citation-checker extra (shepherd_citation_checker) to be in use and to process an attacker-influenced document containing a reference URL. The attacker must control authoritative DNS for the URL's hostname to win the time-of-check/time-of-use race: return a guard-passing public IP during validation, then rebind to an internal address before fetch re-resolves at connect time. Limiting factors: a victim must actually run the citation check on the attacker-planted document (UI:P), the DNS-rebind timing window must be won (AT:P), and impact is limited to reading internal HTTP(S) responses captured in evidence files (no write/RCE). Affects shepherd-ai versions through 0.3.1.

All signals point to a genuinely low-priority issue. The CVSS 4.0 base score is 2.3 and the vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N) describes a network-reachable but heavily conditioned flaw: it needs a present attack requirement (AT:P - the DNS re-bind race window) and active user interaction (UI:P - a victim must run the citation checker against an attacker-planted document). Impact is confined to low confidentiality (VC:L) with no integrity or availability effect and no subsequent-system scope. There is no EPSS score, no KEV listing, and no flagged POC in the input, so there is no evidence of active or opportunistic exploitation - the risk is theoretical and targeted rather than wormable. The one caveat: the CVE is classified CWE-367 (TOCTOU) and the description is explicit that the public_url guard validates a resolved address while fetch re-resolves at connect time, so the root cause is well-understood and credible even though real-world exploitability is narrow. Note also that VulnCheck and a public HackMD write-up describe the technique in detail; this raises the chance that working exploit code could surface, but as of this analysis none is confirmed in the provided data.

An attacker authors or edits a document that Shepherd's citation-checker will process, embedding a reference URL on a domain whose DNS the attacker controls. When the citation checker validates the URL, the attacker's DNS answers with a public address that passes the public_url guard; at fetch/connect time the attacker rebinds the hostname to an internal address (e.g., 169.254.169.254 or an internal admin service), so Shepherd issues the GET to the internal service and writes the response into an evidence file the attacker can later read. No public exploit code is identified at time of analysis, though VulnCheck and a HackMD post document the DNS-rebinding method.