Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-h6vv-pcq8-7xm4

MediumCVSS 5.1 / 10

Published Jun 17, 2026·Last modified Jun 17, 2026

Affected Components(0)

No affected components available

Description

Summary

The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse (file:, ftp:, etc.) and probing of internal HTTP destinations.

Details

The migrate endpoint is restricted to the workspace owner role by ACL. The remaining gaps were (a) protocol validation — the controller now parses body.migrationUrl as a URL and rejects anything whose protocol is not http: or https: — and (b) private destination filtering — the worker already runs through useAgent(targetUrl) from request-filtering-agent, which blocks RFC 1918, loopback, and link-local at the socket layer.

Impact

With the workspace owner role, a malformed URL could be used to coerce the migration worker into reading local files or talking to non-HTTP services; combined with the HTTP-only filter, owner-supplied targets could not reach private ranges.

Credit

This issue was reported by Devel Group Security Research Team through @TREXNEGRO. It was independently reported by @Lihfdgjr and [@bugbunny-research (https://github.com/bugbunny-research).

Risk Scores

Base Score

5.1

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. No user interaction is needed for the attacker to exploit this vulnerability.

Threat Intelligence

1.2

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS

0.29%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Medium severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.