The webhook validator in vulnerability-lookup incorrectly treats IPv6 transition addresses—such as NAT64, 6to4, and Teredo—as globally routable, because it only checks the is_global flag. This flaw lets an attacker point a webhook at a host that resolves to one of these transition addresses, thereby causing the application to perform an outbound request to the embedded IPv4 address. If the IPv4 address is a private, loopback, or cloud‑metadata IP, the threat actor can exfiltrate vulnerability data to an internal endpoint while bypassing the embargo on non‑public addresses. The weakness is a classic Server Side Request Forgery, captured by CWE-918, allowing an attacker to gain data exfiltration opportunities and potentially other internal reconnaissance. The flaw is present only in the development HEAD of vulnerability‑lookup; no released version is known to be affected. The vulnerability was introduced in a non‑release branch and the defensive change has already been merged in the current HEAD. No public advisory or patch exists yet, and the CVSS score is 6.9 indicating a moderate‑to‑high severity. The EPSS score is not available, but the vulnerability is not listed in CISA’s KEV catalog. To exploit the flaw an attacker must first register a webhook in the vulnerable application that points to a hostname resolving to a transition address. Once registered, the application performs a DNS lookup, resolves the address, and, believing it to be global, makes a server‑to‑server HTTP request to the embedded internal target. No interaction with the user, no elevated privileges, and no user‑controlled input beyond the webhook URL are required. The damage radius is confined to the application’s outbound network connectivity, but the attacker can read internal data or discover internal services.

The vulnerability affects installations of the vulnerability‑lookup project when running the HEAD commit containing the unpatched webhook validation code. There are no specific vendor product versions supplied; the flaw only applies to the development branch that has not yet been released. Users must verify whether their deployment is based on the current head or a committed release that includes the fix.

With a CVSS score of 6.9 the flaw is considered high risk for impact, though it is mitigated by its limited need for an exposed vulnerable endpoint. The lack of EPSS data means the exact exploitation likelihood is unknown, and it has not been reported in the KEV catalog. However, the attack path is straightforward: register a malicious webhook that resolves via a transition address, then have the application access a private internal URI. Because the application treats the address as global, it will bypass standard SSRF controls. A simple, low‑cost method could be used to exfiltrate data or probe internal network resources.