Quick answers
- Is CVE-2026-54729 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54729 being exploited in the wild.
- How severe is CVE-2026-54729?
- High severity, with a CVSS score of 4, published 31 July 2026.
- Which products and versions are affected?
- HackingRepo Dssrf <= 1.0.4, <=1.0.4; HackingRepo Dssrf-Js < 1.0.5.
- Is there a fix for CVE-2026-54729?
- A patch was published on 2026-06-09: Fix released in version 1.0.5 via PR #102 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54729 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-54729?
- Check whether you run HackingRepo Dssrf or HackingRepo Dssrf-Js at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the is_url_safe() helper function in dssrf versions ≤1.0.4. The function relies solely on dns.resolve4() for address resolution; when the configured DNS resolver (such as 1.1.1.1) returns NXDOMAIN for a localhost or private address query, dns.resolve4() yields no results and the function lacks a fallback to dns.lookup(). This causes the validation to incorrectly treat the request as safe when it should be blocked. An unauthenticated attacker on the network can exploit this by making the vulnerable application fetch internal resources via SSRF. The fix (version 1.0.5+) implements a fallback mechanism to dns.lookup() when dns.resolve4()/resolve6() return empty results, ensuring proper validation regardless of DNS resolver behavior.
Affected products
- HackingRepo dssrf <=1.0.4
Identifiers
- CVE-2026-54729
- GHSA-5846-7qm3-r52j
Timeline
- 2026-07-31: disclosed: Advisory GHSA-5846-7qm3-r52j published on GitHub
- 2026-06-09: patched: Fix released in version 1.0.5 via PR #102