https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Mon, 03 Aug 2026 15:49:40 +0000 https://vulnerability.circl.lu/sighting/def2e5eb-9b40-404e-b1f3-d50a32e0b545/export {"uuid": "def2e5eb-9b40-404e-b1f3-d50a32e0b545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5lrfapvhcrzhy", "content": "CVE-2026-54722 - dssrf: there a critical security bug with remove_at_symbol_in_string\nCVE ID : CVE-2026-54722\n \n Published : July 30, 2026, 5:16 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF ...", "creation_timestamp": "2026-07-30T18:56:13.143049Z"} {"uuid": "def2e5eb-9b40-404e-b1f3-d50a32e0b545", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5lrfapvhcrzhy", "content": "CVE-2026-54722 - dssrf: there a critical security bug with remove_at_symbol_in_string\nCVE ID : CVE-2026-54722\n \n Published : July 30, 2026, 5:16 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF ...", "creation_timestamp": "2026-07-30T18:56:13.143049Z"} https://vulnerability.circl.lu/sighting/def2e5eb-9b40-404e-b1f3-d50a32e0b545/export Thu, 30 Jul 2026 18:56:13 +0000 https://vulnerability.circl.lu/sighting/d47aacdf-26f2-451c-899b-1d10f33a5ed6/export {"uuid": "d47aacdf-26f2-451c-899b-1d10f33a5ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54722", "type": "published-proof-of-concept", "source": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2", "content": "", "creation_timestamp": "2026-07-30T18:35:06.150524Z"} {"uuid": "d47aacdf-26f2-451c-899b-1d10f33a5ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54722", "type": "published-proof-of-concept", "source": "https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2", "content": "", "creation_timestamp": "2026-07-30T18:35:06.150524Z"} https://vulnerability.circl.lu/sighting/d47aacdf-26f2-451c-899b-1d10f33a5ed6/export Thu, 30 Jul 2026 18:35:06 +0000 https://vulnerability.circl.lu/sighting/5fda123c-860f-4387-ba7e-6a8f003109cf/export {"uuid": "5fda123c-860f-4387-ba7e-6a8f003109cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://gist.github.com/alon710/a4455529dbdac06b73f9e7a68363941a", "content": "# CVE-2026-54722: CVE-2026-54722: Server-Side Request Forgery (SSRF) Bypass via Userinfo Stripping in dssrf-js\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54722\n\n## Summary\nAn SSRF validation bypass exists in dssrf-js (v1.0.3 and prior) due to an improper string normalization sequence inside is_url_safe. Before validating the host using Node's WHATWG parser, the helper strips the '@' symbol. This corrupts the parser's authority resolution, while the application's client requests the original, un-sanitized string containing internal IP targets.\n\n## TL;DR\nThe dssrf-js library before 1.0.4 strips the '@' character from URLs during safety validation. This causes the library to validate a safe, mutated host string (e.g., evil.com127.0.0.1) while the downstream client retrieves the original URL, connecting directly to restricted local resources.\n\n## Technical Details\n\n- **CWE ID**: CWE-76: Improper Neutralization of Equivalent Special Elements\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **EPSS Score**: N/A (New 2026 Vulnerability)\n- **Impact**: High Integrity Compromise (VI:H)\n- **Exploit Status**: None (No active public exploits cataloged)\n- **KEV Status**: False\n\n## Affected Systems\n\n- HackingRepo/dssrf-js\n- **dssrf-js**: < 1.0.4 (Fixed in: `1.0.4`)\n\n## Mitigation\n\n- Upgrade the dssrf-js dependency to version 1.0.4 or higher.\n- Implement application-level sanitation to reject URLs containing userinfo sequences before validation.\n- Establish strict egress firewall filtering to block requests targeting local subnets and loopback scopes.\n\n**Remediation Steps:**\n1. Navigate to the application root directory containing package.json.\n2. Execute 'npm install dssrf-js@1.0.4' to upgrade the package version.\n3. Verify that all test cases evaluating internal IP ranges continue to block SSRF requests successfully.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2)\n- [GitHub Issue #97](https://github.com/HackingRepo/dssrf-js/issues/97)\n- [GitHub Pull Request #98](https://github.com/HackingRepo/dssrf-js/pull/98)\n- [Vulnerability Fix Commit](https://github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-54722)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54722) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T18:31:07.073177Z"} {"uuid": "5fda123c-860f-4387-ba7e-6a8f003109cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://gist.github.com/alon710/a4455529dbdac06b73f9e7a68363941a", "content": "# CVE-2026-54722: CVE-2026-54722: Server-Side Request Forgery (SSRF) Bypass via Userinfo Stripping in dssrf-js\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54722\n\n## Summary\nAn SSRF validation bypass exists in dssrf-js (v1.0.3 and prior) due to an improper string normalization sequence inside is_url_safe. Before validating the host using Node's WHATWG parser, the helper strips the '@' symbol. This corrupts the parser's authority resolution, while the application's client requests the original, un-sanitized string containing internal IP targets.\n\n## TL;DR\nThe dssrf-js library before 1.0.4 strips the '@' character from URLs during safety validation. This causes the library to validate a safe, mutated host string (e.g., evil.com127.0.0.1) while the downstream client retrieves the original URL, connecting directly to restricted local resources.\n\n## Technical Details\n\n- **CWE ID**: CWE-76: Improper Neutralization of Equivalent Special Elements\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **EPSS Score**: N/A (New 2026 Vulnerability)\n- **Impact**: High Integrity Compromise (VI:H)\n- **Exploit Status**: None (No active public exploits cataloged)\n- **KEV Status**: False\n\n## Affected Systems\n\n- HackingRepo/dssrf-js\n- **dssrf-js**: < 1.0.4 (Fixed in: `1.0.4`)\n\n## Mitigation\n\n- Upgrade the dssrf-js dependency to version 1.0.4 or higher.\n- Implement application-level sanitation to reject URLs containing userinfo sequences before validation.\n- Establish strict egress firewall filtering to block requests targeting local subnets and loopback scopes.\n\n**Remediation Steps:**\n1. Navigate to the application root directory containing package.json.\n2. Execute 'npm install dssrf-js@1.0.4' to upgrade the package version.\n3. Verify that all test cases evaluating internal IP ranges continue to block SSRF requests successfully.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2)\n- [GitHub Issue #97](https://github.com/HackingRepo/dssrf-js/issues/97)\n- [GitHub Pull Request #98](https://github.com/HackingRepo/dssrf-js/pull/98)\n- [Vulnerability Fix Commit](https://github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-54722)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54722) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T18:31:07.073177Z"} https://vulnerability.circl.lu/sighting/5fda123c-860f-4387-ba7e-6a8f003109cf/export Thu, 30 Jul 2026 18:31:07 +0000 https://vulnerability.circl.lu/sighting/1338e7f8-3e45-4016-8136-b2888544f32f/export {"uuid": "1338e7f8-3e45-4016-8136-b2888544f32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://bsky.app/profile/kynth.studio/post/3mruwkbv7zy2r", "content": "dssrf's SSRF bypass (CVE-2026-54722): it strips '@' from the raw URL string before new URL() parses it, so the hostname gets corrupted and internal IPs are never checked. Validate parser output, never raw text. #software", "creation_timestamp": "2026-07-30T17:08:56.046967Z"} {"uuid": "1338e7f8-3e45-4016-8136-b2888544f32f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54722", "type": "seen", "source": "https://bsky.app/profile/kynth.studio/post/3mruwkbv7zy2r", "content": "dssrf's SSRF bypass (CVE-2026-54722): it strips '@' from the raw URL string before new URL() parses it, so the hostname gets corrupted and internal IPs are never checked. Validate parser output, never raw text. #software", "creation_timestamp": "2026-07-30T17:08:56.046967Z"} https://vulnerability.circl.lu/sighting/1338e7f8-3e45-4016-8136-b2888544f32f/export Thu, 30 Jul 2026 17:08:56 +0000