CVE-2026-65968
ideon: Unauthenticated SSRF in /api/proxy/image via WHATWG bracketed/hex-mapped IPv6 bypass of isSafeUrl guard
ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLE_HTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
| Product | Versions | Authority |
|---|---|---|
| ideon 3xpyth0n |
< 0.9.4 (affected) | CNA: GitHub_M |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 5.3 medium |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | CNA: GitHub_M |
| 4.0 / 5.3 medium |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366rCNA: GitHub_M · x_refsource_CONFIRM
- https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01CNA: GitHub_M · x_refsource_MISC
- https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4CNA: GitHub_M · x_refsource_MISC
- https://github.com/3xpyth0n/ideon/commit/58e2f26bb7259d24c963a753962ac34f56c63b01[email protected]
- https://github.com/3xpyth0n/ideon/releases/tag/v0.9.4[email protected]
- https://github.com/3xpyth0n/ideon/security/advisories/GHSA-cvcr-fcf6-366r[email protected]
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.