compliance-trestle version 4.0.3 contains an SSRF allowlist bypass vulnerability in its URLSecurityValidator component. The validator attempts to block requests to loopback, link-local, and cloud metadata IP ranges but fails to properly normalize IPv4-mapped IPv6 addresses and does not block the IPv4 unspecified address 0.0.0.0. This allows crafted URLs using these address forms to bypass the validator and reach restricted internal services. The vulnerability affects workflows that fetch OSCAL artifacts referencing such URLs, potentially exposing internal network resources. The issue is fixed in compliance-trestle version 4.1.0.