The Alt Text Generation experiment exposes an ai/alt-text-generation ability. This ability allows you to pass in any arbitrary image_url and it will attempt to download that URL and send to the LLM to generate alt text.
An authenticated user holding only the Author role can supply any URL to this ability, including URLs meant to be internal to the server hosting the site. The body of that response is then passed to the site's configured AI provider and from here, the user holding the Author role can ask the AI model to return its verbatim content.
AI version 1.3.0 has been released which fixed the problem by adding additional checks around this image_url, ensuring this URL is publicly available and corresponds to an actual image file, not just a random document.
trap-bytes Reporter
dkotter Remediation developer
The Alt Text Generation experiment exposes an
ai/alt-text-generationability. This ability allows you to pass in any arbitraryimage_urland it will attempt to download that URL and send to the LLM to generate alt text.An authenticated user holding only the Author role can supply any URL to this ability, including URLs meant to be internal to the server hosting the site. The body of that response is then passed to the site's configured AI provider and from here, the user holding the Author role can ask the AI model to return its verbatim content.
AI version 1.3.0 has been released which fixed the problem by adding additional checks around this
image_url, ensuring this URL is publicly available and corresponds to an actual image file, not just a random document.