isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
CVSS 3.1MEDIUM 5.3·Network·No auth·No interaction·EPSS 0.00563·Published 2023-01-30·Fixed in 1.2CWE-918