The dssrf library contains a logic flaw in its URL sanitization routine; it removes the @ userinfo delimiter before parsing a URL, enabling an attacker to supply a crafted URL that bypasses the library’s internal‑IP validation checks. Because of this, a client that relies on dssrf for SSRF checks can inadvertently connect to internal services, exposing those services to an attacker. The weakness is identified as CWE‑76, reflecting a path or URL manipulation that leads to information exposure.

The vulnerability affects the HackingRepo:dssrf-js package in all releases prior to version 1.0.4. Users who depend on any version of this library without upgrading to 1.0.4 or later are at risk.

The CVSS score of 8.7 indicates a high severity of this flaw. The EPSS score of < 1% reflects a low but measurable probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploits in the wild as of this analysis. Attackers would need to inject or supply a malicious URL to an application that uses the dssrf library; the library would then allow the application to reach internal network resources, potentially allowing data extraction or further lateral movement.