CVE-2026-103980

UNKNOWN 0.0

ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 ranges (loopback ::1, ULA fc/fd, link-local fe80) but does not recognize IPv4-mapped (::ffff:), NAT64 well-known (64:ff9b::/96, RFC 6052), NAT64 local-use (64:ff9b:1::/48, RFC 8215), 6to4 (2002::/16, RFC 3056), or Teredo (2001::/32, RFC 4380) encodings. An authenticated user can supply these addresses in link URLs to reach cloud metadata endpoints (169.254.169.254), localhost services, and RFC 1918 internal networks through the link preview metadata fetcher. This issue has been patched in version 0.9.6.

CWE	CWE-918
Vendor	3xpyth0n
Product	ideon
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for 3xpyth0n ideon

Be the first to know when new unknown vulnerabilities affecting 3xpyth0n ideon are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

3xpyth0n / ideon

< 0.9.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/3xpyth0n/ideon/security/advisories/GHSA-fwh7-rv72-xh5q github.com: https://github.com/3xpyth0n/ideon/commit/c4ffb1e50132b9264bde4a679fe24f084f20069d github.com: https://github.com/3xpyth0n/ideon/releases/tag/v0.9.6