Shepherd
Monthly
Shepherd (shepherd-ai) through 0.3.1 contains a DNS-rebinding bypass of the citation-checker's public_url SSRF guard, letting an attacker who controls authoritative DNS for a reference URL planted in a checked document redirect the outbound fetch to internal HTTP(S) services and capture the responses inside evidence files. Exploitation requires the shepherd_citation_checker extra to be in use and a victim to actually run a citation check on the attacker-influenced document, then win a time-of-check/time-of-use race in which the guard validates a public IP but the connection re-resolves the hostname to an internal address; no public exploit identified at time of analysis. Impact is read-only information disclosure (low confidentiality, no integrity or availability effect), consistent with the low CVSS 4.0 base score of 2.3 and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, and the attacker does not need credentials but does need user interaction and DNS control.
Shepherd (shepherd-ai) through 0.3.1 contains a DNS-rebinding bypass of the citation-checker's public_url SSRF guard, letting an attacker who controls authoritative DNS for a reference URL planted in a checked document redirect the outbound fetch to internal HTTP(S) services and capture the responses inside evidence files. Exploitation requires the shepherd_citation_checker extra to be in use and a victim to actually run a citation check on the attacker-influenced document, then win a time-of-check/time-of-use race in which the guard validates a public IP but the connection re-resolves the hostname to an internal address; no public exploit identified at time of analysis. Impact is read-only information disclosure (low confidentiality, no integrity or availability effect), consistent with the low CVSS 4.0 base score of 2.3 and the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, and the attacker does not need credentials but does need user interaction and DNS control.