CodeVetter · local evidence export

Server-side request forgery in Python

codevetter-public-benchmark/py-ssrf

detected · high confidence

Verification

Code reviewcompleted

Qualified static finding recorded.

Executable testnot verified

No exact-current runtime evidence is included.

Audiencenot run

No audience validation occurred.

Finding

highbenchmark ground truth

ssrf

The server fetches a user-supplied URL with no scheme, host, or private-range restrictions, allowing requests to cloud metadata endpoints (e.g. 169.254.169.254) to steal credentials or to internal services for pivoting.

source.py:9