Two AriaCast metadata handlers accepted an artwork address from any host on the local network and passed it directly into an HTTP request. That meant a LAN client could make Music Assistant contact an internal-only service or even its own localhost API; the handlers also returned raw exception text.
The fix limits artwork requests to the peer that supplied the address, disables redirects, caps the response at 4 MB and permits only one artwork fetch at a time. Failed requests now return a generic error while details stay in the debug log. The flaw was identified by automated code scanning.