CVE-2026-54722: dssrf has an SSRF bypass with remove_at_symbol_in_string
is_url_safe in v1.0.3 contains an SSRF bypass. remove_at_symbol_in_string is applied to the raw URL string before new URL() parses it. This strips the @ that separates userinfo from host, corrupting the hostname so internal IPs are never checked.
References
- github.com/HackingRepo/dssrf-js/commit/9211f91bf532433a1a1b27d946571546a63664b3
- github.com/HackingRepo/dssrf-js/issues/97
- github.com/HackingRepo/dssrf-js/pull/98
- github.com/HackingRepo/dssrf-js/security/advisories/GHSA-cg4g-m8jx-vjv2
- github.com/advisories/GHSA-cg4g-m8jx-vjv2
- nvd.nist.gov/vuln/detail/CVE-2026-54722
Code Behaviors & Features
Detect and mitigate CVE-2026-54722 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →