YAML Metadata Warning: empty or missing yaml metadata in repo card (https://huggingface.co/docs/hub/model-cards#model-card-metadata)

PoC: wandb SSRF via Unvalidated Artifact URLs (CWE-918)

Vulnerability

The wandb Python SDK (v0.24.2) fetches arbitrary URLs from artifact manifests and GraphQL responses without any URL validation or SSRF protection.

#	File	Line	Sink
1	`http_handler.py`	94	`_get_stream(ref_url)` — artifact HTTP ref
2	`internal_api.py`	1294	`requests.get(directUrl)` — GraphQL file
3	`artifact.py`	1065	`session.get(direct_url)` — manifest fetch
4	`wandb_storage_policy.py`	174	`session.get(url)` — entry download

Zero URL validation, zero internal IP blocking, zero redirect control.

pip install wandb
python3 poc_wandb_ssrf.py

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support