Compliance-trestle's URLSecurityValidator is designed to prevent server-side request forgery by blocking access to loopback, link-local, cloud-metadata, and internal network endpoints. However, in affected versions (<3.12.4 and >=4.0.0 <4.1.0), the blocklist is incomplete: it fails to canonicalize IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) which resolve to IPv6Address objects not matched by the IPv4 block ranges, and it does not block the unspecified IPv4 address 0.0.0.0. This allows an attacker who can influence OSCAL artifacts fetched by trestle to bypass protections and cause HTTPSFetcher and SFTPFetcher to contact restricted internal services. The vulnerability is addressed in versions 3.12.4 and 4.1.0.

An attacker able to supply or influence OSCAL artifacts fetched by compliance-trestle can bypass URL validation controls to make the software access internal network endpoints, including loopback interfaces, link-local addresses, cloud instance-metadata services, and unspecified addresses. This could lead to unauthorized internal network interactions, potentially exposing sensitive internal resources or metadata. The CVSS 4.0 score is 8.6 (high severity), indicating significant impact with network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Upgrade compliance-trestle to version 3.12.4 or later, or 4.1.0 or later, where this vulnerability is fixed. No other mitigation is required as the issue is resolved in these versions.