From 8ac631d6158c0f04976a0d0f7ca9ec2b981efeb5 Mon Sep 17 00:00:00 2001
From: decolua <decoluadt@example.com>
Date: Fri, 26 Jun 2026 12:14:30 +0700
Subject: [PATCH] fix(ssrf): block IPv6-mapped IPv4 addresses
 (GHSA-hj98-rc6w-m8cw)

isBlockedIpv6() did not normalize ::ffff:<ipv4>, allowing the SSRF
filter to be bypassed. Extract and validate via isBlockedIpv4().

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/shared/utils/ssrfGuard.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/shared/utils/ssrfGuard.js b/src/shared/utils/ssrfGuard.js
index 1176d7b6..40336acf 100644
--- a/src/shared/utils/ssrfGuard.js
+++ b/src/shared/utils/ssrfGuard.js
@@ -38,6 +38,8 @@ function isBlockedIpv4(host) {
 
 function isBlockedIpv6(host) {
   const h = host.replace(/^\[|\]$/g, "").toLowerCase();
+  const v4Mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/);
+  if (v4Mapped) return isBlockedIpv4(v4Mapped[1]);
   if (h === "::1" || h === "::") return true;
   return h.startsWith("fe80:") || h.startsWith("fc") || h.startsWith("fd");
 }