safeurl CVE-2026-77866

Requires an application that uses safeurl (>=0.1.0) in its default blacklist/blocklist mode to validate attacker-influenced URLs before making requests; deployments using the allowlist/whitelist option are NOT vulnerable because unmatched addresses are rejected there. The attacker must be able to supply or influence a URL that the application passes to SafeURL.get/validate_url, and must express the internal target so it evades IPv4-only matching: as an IPv6 literal address, as a hostname whose blocklist entry is IPv6 (never matches), or as a host that resolves to no IPv4 address (AAAA-only or non-resolving), which is accepted regardless of destination. No authentication or user interaction is required at the library layer.

This is a genuine SSRF-protection-bypass in a defensive library, but the real-world urgency signals are mixed. The vendor CVSS 4.0 score of 9.0 is driven by VC:H/SC:H (reading internal resources across a scope boundary) with PR:N/UI:N, reflecting that an attacker who controls a validated URL can reach blocked internal destinations. However, EPSS is only 0.46% (39th percentile), there is no CISA KEV listing, and no public exploit code was identified - so this is not evidence of active, widespread exploitation. The AT:P in the 4.0 vector correctly signals a real precondition: the flaw only matters for deployments using safeurl's default blacklist/blocklist mode; allowlist deployments are explicitly unaffected because an unmatched address is rejected there. The high score is defensible for affected deployments, but this is a niche Elixir library (not even published to Hex, installed from GitHub), so aggregate exposure is limited. Net: high technical severity where deployed, low likelihood of mass exploitation - prioritize for the small population that actually depends on safeurl in blacklist mode.

An application uses SafeURL in its default blacklist mode to vet user-supplied URLs (e.g., a webhook or link-preview feature) before fetching them, trusting it to block internal targets. The attacker submits the internal target as an IPv6 literal, or as a hostname that has only a AAAA (IPv6) record or no IPv4 address at all; safeurl matches nothing against its IPv4-only reserved/blocklist and returns the URL as safe, so the server issues the request to the internal destination. No public proof-of-concept was identified, but the bypass is deterministic and trivial to reproduce given the described IPv4-only matching logic.