CVE-2026-103980
- Source
- https://cve.org/CVERecord?id=CVE-2026-103980
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103980.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-103980
- Aliases
-
- GHSA-fwh7-rv72-xh5q
- Published
- 2026-11-11T20:58:51Z
- Modified
- 2026-11-13T02:46:08Z
- Severity
-
- 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview
- Details
-
ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103980.json" }- References
-
- https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6
- https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103980.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-103980
- https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d
Affected packages
Git / github.com/3xpyth0n/ideon
Affected ranges
- Type
- GIT
- Repo
- https://github.com/3xpyth0n/ideon
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "0.9.6" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "c4ffb1e50132b9264bde4a679fe24f084f20069d" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v0.9.6", "range": [ { "fixed": "dfc796d33ce3a78c0871e08ba853aee3d2334ebc" } ], "source": "REFERENCES_TAG" } ] }