Instructor is a Python library that wraps multiple LLM providers (OpenAI, Anthropic, Gemini, Mistral, etc.) and converts model responses into validated Pydantic models. It patches provider client methods to accept response_model, handles schema generation, retries, and response parsing, and offers optional caching, multimodal inputs (images, audio, PDF), batch processing, and CLI tooling. It is usually embedded inside backend services, data pipelines, or scripts that forward user or document content to external LLM APIs. The library itself is not a web server, but it often runs in environments where untrusted user input influences prompts and where returned data may drive downstream automation.
Bedrock image URL handling enables SSRF via requests.get
ReportPatch
Severity
High
Adjust to improve accuracy in future scans
Commit
Repository
567-labs/instructor
Summary
Introduced SSRF risk by fetching user-controlled http(s) image URLs during Bedrock message conversion.
The commit adds _openai_image_part_to_bedrock and wires it into message preparation. When a message contains an OpenAI-style image_url part, the code issues requests.get() to the supplied URL and embeds the response bytes into the Bedrock request. There is no allowlist, IP filtering, or size limits, and redirects are allowed by default. If an attacker can control message content (common in services that accept user prompts), they can force the host to fetch internal URLs (e.g., metadata services or internal APIs) and exfiltrate the response bytes to the external Bedrock provider. This behavior did not exist before, as Bedrock previously rejected non-text content.
Validation
Identify http(s) fetch of image_url with requests.get without allowlist/size limit in _openai_image_part_to_bedrock.
Confirm OpenAI-style image_url parts are passed to _openai_image_part_to_bedrock in _to_bedrock_content_items.
Confirm _prepare_bedrock_converse_kwargs_internal uses _to_bedrock_content_items on message content.
Demonstrate runtime fetch of attacker-controlled URL via PoC and show bytes returned.
Assess for mitigations (scheme restriction only; no IP/allowlist).
Codex