GRAPHIFY CVE-2026-51385

GRAPHIFY is an open-source Python library (based on function naming conventions and the _build_opener reference, which is a Python urllib construct) that provides web content fetching and scraping functionality. The affected attack surface consists of five interconnected URL-handling functions: validate_url performs domain/URL allowlisting, safe_fetch wraps the HTTP request lifecycle, _build_opener constructs the urllib opener object, _fetch_html retrieves HTML content, and _download_binary retrieves binary payloads. The critical reference to lock.cmpxchg8b.com/rebinder.html - a well-known DNS rebinding tool - confirms the root attack class: an attacker registers a domain whose DNS TTL is set extremely short and alternates between a public IP (passing validate_url) and an internal/loopback IP (the actual target). Because Python's urllib does not re-resolve DNS mid-connection by default, but GRAPHIFY's validation and fetch steps are separated in time, the rebinding window allows _fetch_html and _download_binary to reach internal endpoints after validation has passed. CWE data was not provided, but this maps to CWE-918 (Server-Side Request Forgery) as the root cause, with RCE as a secondary consequence achievable via internal service exploitation or download-and-execute behavior in _download_binary. CPE data in the NVD submission is placeholder (n/a), so affected version range is sourced solely from the description and GitHub PoC.