THREAT OPS › Threat News › [GHSA] GHSA-cg4g-m8jx-vjv2 (high) — dssrf has an SSRF bypass with remove_at_symbol_in_string
[GHSA] GHSA-cg4g-m8jx-vjv2 (high) — dssrf has an SSRF bypass with remove_at_symbol_in_string
GHSA-cg4g-m8jx-vjv2 Severity: high CVE: CVE-2026-54722
dssrf has an SSRF bypass with remove_at_symbol_in_string
## Summary
`is_url_safe` in v1.0.3 contains an SSRF bypass. `remove_at_symbol_in_string` is applied to the raw URL string **before** `new URL()` parses it. This strips the `@` that separates userinfo from host, corrupting the hostname so internal IPs are never checked.
## Vulnerabili
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-54722cve
- http://evil.com@127.0.0.1/`url
- http://evil.com127.0.0.1/`url
- http://10.0.0.1:80url
- http://2@10.0.0.1/url
- http://10.0.0.1/url
Original source: https://github.com/advisories/GHSA-cg4g-m8jx-vjv2