Unverified50% confidenceEventExact time
在演示中，豆包按照提示词执行后不仅确认了URL预览功能存在SSRF漏洞，还验证出任意文件读取问题
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/9/2026
First Seen
Valid until: 1/7/2027
Sources
Related Entities
Related Claims
UnverifiedSSRF利用中常被检测的危险协议包括file://（读取本地文件）、dict://（探测端口开放状态）、ftp://（有时可绕过过滤）67% similarUnverifiedXZ Utils 后门的恶意代码隐藏在测试用二进制文件中，通过修改后的 m4 构建脚本在编译时提取注入，并通过劫持 RSA_public_decrypt 函数检查特定公钥65% similarUnverifiedNetworking capabilities such as WebFetch introduce security risks including prompt injection, SSRF, and sensitive data leakage.64% similarUnverifiedHook技术同样的原理也被用于拦截XHR请求、监控Cookie读写、追踪加密函数调用等安全研究场景64% similarUnverifiedIn 2023, researchers demonstrated hiding malicious instructions in invisible text areas of web pages, successfully hijacking a GPT-4-based browser agent into performing unauthorized operations.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/991173API
curl https://kongchang.com/api/v1/knowledge/claims/991173MCP
get_claim(id=991173)