trawl vulnerabilities

CVEs whose affected-version data names the trawl package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-122140Medium· 5.8

3d ago

Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass

Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses li…

▾ Sunlitgermondai · trawlEPSS 0.35%via CVEORG