hemmelig allows SSRF Filter bypass via Secret Request functionality

Description

A Server-Side Request Forgery (SSRF) filter bypass vulnerability exists in the webhook URL validation of the Secret Requests feature. The application attempts to block internal/private IP addresses but can be bypassed using DNS rebinding (e.g., localtest.me which resolves to 127.0.0.1) or open redirect services (e.g., httpbin.org/redirect-to).

Recommendation

Update the hemmelig package to the latest compatible version. Followings are version details:

• Affected version(s): < 7.3.3
• Patched version(s): 7.3.3

References

• GHSA-vvxf-wj5w-6gj5
• CVE-2025-69206
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Elliptic Uses a Cryptographic Primitive with a Risky Implementation - CVE-2025-14505
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• MetaMask SDK indirectly exposed via malicious [email protected] dependency - Vulnerability
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881

Tags:

npm

hemmelig