What is GHSA-hvwx-hhfv-4fvx?

GHSA-hvwx-hhfv-4fvx is a security advisory published by GitHub Security Advisories with Medium severity. Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the...

Which CVE IDs does GHSA-hvwx-hhfv-4fvx cover?

GHSA-hvwx-hhfv-4fvx covers the following CVE IDs: CVE-2026-110254. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hvwx-hhfv-4fvx?

GHSA-hvwx-hhfv-4fvx has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-hvwx-hhfv-4fvxMediumCVSS 4.3

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the...

Vendor

GitHub Security Advisories

Published

October 13, 2026

Last Modified

October 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-110254 →

📋 Description

Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check NAT64, 6to4, and Teredo IPv6 transition ranges. Authenticated attackers can embed loopback, cloud metadata, or private IPv4 addresses in transition IPv6 literals within notification, backup, template, registry, git, or secret provider URLs to reach internal services.

🔗 References (4)

https://github.com/Finsys/dockhand/security/advisories/GHSA-8rv7-48hx-jfw9
https://nvd.nist.gov/vuln/detail/CVE-2026-110254
https://www.vulncheck.com/advisories/dockhand-before-1.0.45-ssrf-via-ipv6-transition-address-bypass-in-ipcategory
https://github.com/advisories/GHSA-hvwx-hhfv-4fvx