Submit #865113: HKUDS nanobot 0.2.1 Server-Side Request Forgery (CWE-918)

# Technical Details
A provider-response SSRF vulnerability exists in the `_download_image_data_url` method in `nanobot/providers/image_generation.py` of nanobot.

The application fails to validate provider-returned image URLs with the built-in `validate_url_target()` network guard before downloading `data[].url` values. A malicious or compromised configured image provider can therefore return a loopback or private-network URL, causing the nanobot host to fetch internal resources and persist the returned bytes as generated media.

# Vulnerable Code
File: nanobot/providers/image_generation.py
Method: _download_image_data_url()
Why: The function directly performs `client.get(url)` on provider-controlled URLs without applying SSRF target validation, even though the project already ships `nanobot/security/network.py` defenses for loopback and internal addresses.

# Reproduction
1. Configure nanobot 0.2.1 with an image provider that returns `{"data":[{"url":"http://127.0.0.1:<port>/internal.png"}]}` instead of inline `b64_json`.
2. Trigger `generate_image` through the normal `POST /v1/chat/completions` API path using the provided integration harness.
3. Observe that the canary loopback server is contacted and the saved generated image artifact contains the canary response bytes.

# Impact
- A malicious provider can force the nanobot host to issue HTTP requests to loopback, RFC1918, or metadata-adjacent targets reachable from the runtime.
- Internal service discovery and retrieval of attacker-shaped content become possible through the image-generation workflow.

• Source: ⚠️ https://gist.github.com/YLChen-007/44bc77ac259e461c6938cc6c286c4430
• User: Eric-c (UID 96848)
• Submission: 06/22/2026 04:16 (2 months ago)
• Moderation: 08/07/2026 14:08 (2 months later)
• Status: Accepted
• VulDB entry: 387000 [HKUDS nanobot up to 0.2.1 Provider-returned Image URL image_generation.py _download_image_data_url server-side request forgery]
• Points: 20