Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the build_exclusive_url function in the connection.rb file. An attacker can cause requests to be sent to arbitrary hosts by supplying a protocol-relative URL as input.
Workaround
This vulnerability can be mitigated by validating and sanitizing user-controlled input before passing it to request methods, such as rejecting or stripping input that starts with // followed by a non-/ character, using an allowlist of permitted path prefixes, or prepending ./ to all user-supplied paths.