Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A URL is fetched after only verifying its prefix (e.g., startsWith('http')), without validating against internal or private IP addresses. This can allow Server-Side Request Forgery (SSRF) attacks against internal endpoints.
MimeNode is initialized with raw content without specifying disableFileAccess or disableUrlAccess security options. This can allow arbitrary file inclusion or SSRF (CVE-2026-82659) if untrusted input reaches the raw message option.
Outbound HTTP request is constructed using an unvalidated URL parameter without checking for loopback/private/metadata IP addresses or using a safe HTTP client. This can lead to Server-Side Request Forgery (SSRF).
Proxied request omits SSRF IP-pinning handlers without failing closed or verifying proxy trust, allowing SSRF (CWE-918).
WeasyPrint's HTML renderer was instantiated without a custom `url_fetcher`. By default, WeasyPrint resolves external URLs and `file://` resources, which can enable Server-Side Request Forgery (SSRF) and arbitrary local file disclosure.
Calling `InetAddress.getByName()` during deserialization without verifying that the input is an IP address literal causes eager DNS resolution of arbitrary hostnames, leading to DNS-based SSRF and internal host enumeration.
Decoding a URI scheme without validating the result against RFC 3986 scheme syntax allows malformed schemes (such as percent-encoded slashes or CRLF) to bypass hostname allowlists and SSRF protections.
URI component resolution serializes resolved components without canonicalizing the host (e.g. converting IDN/Unicode domain names to ASCII). This can lead to host confusion, allowlist bypasses, or SSRF when resolving scheme-relative or schemeless references.
Calling 'unescape()' on a URI host component decodes '%25' into '%', causing doubly-encoded hostnames to be decoded multiple times during normalization or recomposition. This violates RFC 3986 and can lead to SSRF or host-based access control bypasses. Use a dedicated percent-encoding normalizer that preserves reserved characters and does not double-decode '
An unanchored prefix regular expression is used to validate a URL. Without an end anchor (`$`), trailing slash (`/`), or delimiter, attacker-controlled domains (e.g., `https://example.com.attacker.com` or `https://example.com@attacker.com`) will pass validation. Parse the URL using `new URL(url)` and validate `urlObj.hostname` instead.
Peer address validation checks address ranges without blocking link-local, unique-local, and site-local internal address scopes by default. This can allow authenticated relay clients to access internal services and cloud metadata endpoints (SSRF).
Resource URL constructed via `urljoin` is passed directly to an HTTP client request without verifying whether the target resolves to a local, private, or restricted IP/hostname. This can allow Server-Side Request Forgery (SSRF). Ensure destination URLs are validated before issuing HTTP requests.
Validating IP addresses using `ipaddress.ip_address()` without resolving domain names via DNS leaves the application vulnerable to SSRF. Domain names pointing to internal or private IP addresses will bypass IP-based access controls if `ValueError` is ignored.
Unsafe schema dereferencing using `json-schema-ref-parser` with default settings allows resolving arbitrary local files and external URLs via `$ref` pointers. This can lead to Server-Side Request Forgery (SSRF) and arbitrary file read. Configure the resolver to disable external/file resolution or use internal-only JSON pointer resolution.
A user-controlled or unvalidated URL is passed directly to an HTTP client without host/IP validation, potentially allowing Server-Side Request Forgery (SSRF).
Base64 decoding error is ignored in an inline 'if' initialization checking '$ERR == nil' without an 'else' branch or handling '$ERR != nil'. If decoding fails, execution silently proceeds with un-decoded or invalid data.
A URL is validated for SSRF or allowlisting but fetched using 'requests' without setting 'allow_redirects=False'. By default, 'requests' follows HTTP redirects, allowing an attacker to bypass URL validation via 301/302 redirects to internal or cloud metadata services.
Using unpinned `ClientNetwork` with ACME `ClientV2` allows the ACME client to follow arbitrary server-supplied URLs (such as newOrder, authz, or finalize endpoints), leading to Server-Side Request Forgery (SSRF). Outbound ACME requests should be pinned to the directory hostname.
Relying on `ipaddress.ip_address(...).is_global` alone for SSRF validation is unsafe. IPv6 addresses embedding private IPv4 addresses (such as NAT64, 6to4, Teredo, or IPv4-mapped IPv6) may return True for `is_global`. Inspect embedded IPv4 addresses before validating.
WeasyPrint HTML renderer instantiated without specifying a restrictive url_fetcher. By default, WeasyPrint resolves local files and network URLs (file://, http://, etc.), allowing SSRF and Local File Inclusion when rendering untrusted HTML or Markdown. Pass a restrictive url_fetcher parameter.
Resolving only IPv4 addresses with 'resolve4' during hostname validation leaves IPv6 addresses (AAAA records) unvalidated, allowing potential SSRF bypasses. Use 'dns.lookup' with '{ all: true }' or resolve both address families.
Directly concatenating unvalidated `@odata.id` links with a base URL may allow Server-Side Request Forgery (SSRF) if the `@odata.id` contains a hostile host or scheme. Pass the operator-supplied base URL and the `@odata.id` link to a robust URL builder like `lib.redfish.build_url()` instead.
Catching ValueError from ipaddress.ip_address() without resolving the hostname via DNS allows domain names targeting private, loopback, or metadata IP addresses to bypass SSRF checks.
SSO management handler does not perform authorization or administrator checks before invoking sensitive SSO configuration or connectivity operations.
