The vulnerability is a server‑side request forgery (SSRF) in the multimodal chat completions endpoint of text‑generation‑inference 3.3.7. The fetch_image function accepts an arbitrary image_url without validating that the URL targets an external, non‑internal resource, and the HTTP client follows redirects by default, allowing attackers to bypass scheme checks through redirect chains. An unauthenticated attacker can coerce the server into issuing arbitrary HTTP GET requests, potentially accessing internal services or cloud metadata endpoints for credential harvesting.

The affected product is Huggingface's text‑generation‑inference server. Versions up to and including 3.3.7 that expose the multimodal chat completions endpoint are vulnerable. No other vendors or product variants are indicated.

The flaw carries a CVSS score of 6.9. An attacker with network reachability can target the vulnerable server to perform internal network discovery or credential theft. The EPSS score is <1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, so it is not currently a known exploited vulnerability.