CVE-2025-9960CWE-918ssrf

CVE-2025-9960

published September 22, 2025

CVSS
6.9
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

A restriction bypass vulnerability in is-localhost-ip could allow attackers to perform Server-Side Request Forgery (SSRF).

This issue affects is-localhost-ip: 2.0.0.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-09-22T23:16Z
References (2)
https://fluidattacks.com/advisories/registrada · [email protected]https://github.com/tinovyatkin/is-localhost-ip · [email protected]
EPSS history
Timeline
  • 22 SEP 18:35Z
    is-localhost-ip 2.0.0 - SSRF via Restrictions bypass
    cvelistv5