Executive brief
prompts.chat, a web application for managing AI prompts, is vulnerable to a security flaw in its media generation feature. An authenticated user can trick the server into sending requests to a malicious destination, which automatically includes the site's Fal.ai API key. This allows an attacker to steal credentials, incur unauthorized costs on the victim's AI account, and probe the internal network.
Technical details
A Server-Side Request Forgery (SSRF) exists in the Fal.ai media status polling feature within `src/lib/plugins/media-generators/fal.ts`. The application accepts a user-provided `token` parameter containing pipe-separated URLs which are subsequently fetched by the server. Because the application fails to validate these URLs before execution, it attaches the `FAL_API_KEY` in the Authorization header of requests sent to attacker-controlled endpoints. An authenticated attacker can exploit this to leak sensitive API credentials, scan internal network infrastructure, or access cloud metadata services. The vulnerability was addressed in commit 30a8f04 by implementing origin validation for the polling URLs.
Affected products
- fka prompts.chat prior to commit 30a8f04
Timeline
- 2026-03-24: disclosed: Vulnerability discovered and reproduced by researcher
- 2026-03-25: patched: Fix committed to repository
- 2026-04-03: advisory: Initial NVD publication