Threats tagged 'ghsa-42jx-rr99-g8v2'

Trawl versions from 1.5.0 up to but not including 1.10.0 have a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass the MCP outbound URL policy by using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses or use redirects to access internal resources such as loopback, private networks, and cloud metadata services, potentially reading sensitive responses.