Music Assistant restricts artwork references reported by network devices before passing them to its media tools. Previously, a device could supply an address for another supported streaming protocol and make the cover-art loader contact it.
Marvin Schenkel limits extraction to existing local files or ordinary web URLs and prevents one kind of input from opening the other through an embedded reference. Helper processes also stop inheriting Home Assistant’s Supervisor tokens. Ordinary web cover extraction continues to work.