fix: the image constructor accepts a src parameter... in image.js

[anupamme]

Summary

Fix high severity security issue in src/image.js.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	src/image.js:88
Assessment	Likely exploitable

Description: The Image constructor accepts a src parameter that, when identified as a remote URL via Util.isRemoteUrl(src), is passed directly to the Fetch() function without any URL validation or allowlist checking. There is no restriction on internal IP addresses (e.g., 169.254.169.254, 10.x.x.x, 127.0.0.1) or protocols. If an application using this library allows user-controlled input to flow into the src parameter, an attacker can make the server fetch internal resources.

Evidence

Exploitation scenario: An attacker who controls the src parameter (e.g., via a CMS image URL field or API parameter) provides a URL like http://169.254.169.254/latest/meta-data/iam/security-credentials/ or.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/image.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path, and the project's existing tests still pass, so intended behavior is unchanged.

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security