The vulnerability in twenty (<= 1.18.0) involves bypassing SSRF protections by exploiting the difference in IP address normalization between Node.js's URL parser and the isPrivateIp utility. Specifically, IPv4-mapped IPv6 addresses are normalized to a compressed hex form by Node.js, but the SSRF check only recognizes dotted-decimal IPv4 notation. This discrepancy allows an attacker with authentication to send requests to internal IPs, including cloud metadata services, bypassing both the primary SSRF check and the socket lookup validation event. This can lead to unauthorized access to sensitive internal resources and credential exfiltration.

An authenticated attacker can exploit this SSRF vulnerability to reach internal IP addresses that are normally inaccessible, including cloud metadata endpoints. This can result in the exposure of sensitive information such as IAM credentials, which could lead to further compromise of the environment. The vulnerability has a CVSS 4.0 base score of 8.3, indicating high severity. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected twenty versions or implementing network-level controls to prevent unauthorized internal requests from the application. Monitoring and restricting authenticated user capabilities may also reduce risk.