# Trawl: a hex IPv6 address sends its MCP scraper to loopback

> Trawl's private-address filter missed hex IPv4-mapped IPv6 addresses, so every spelling of a loopback literal passed it.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Trawl
- **Disclosed:** 2026-11-03
- **CVE:** CVE-2026-122140
- **CVSS:** 6.3
- **Affects:** Trawl
- **Research by:** Leardian
- **Primary source:** https://github.com/germondai/trawl/security/advisories/GHSA-mj45-84p2-v77q
- **Page:** https://theinjection.dev/items/trawl-mcp-mapped-ipv6-ssrf/

Trawl's optional MCP interface classified IPv4-mapped IPv6 addresses written in hex as public, so a caller who supplied a scrape URL could reach loopback and private-range services. Fixed in 1.10.0; 1.5.0 through 1.9.3 are affected.

## What happened

Trawl, a self-hosted web scraper for applications and AI agents, published advisory GHSA-mj45-84p2-v77q on 3 November 2026 for a server-side request forgery flaw in its optional MCP interface. Leardian reported the issue and is credited on the advisory, and the fix shipped in version 1.10.0. The GitHub Advisory Database assigned CVE-2026-122140 the following day.

## How it works

Trawl's outbound URL policy recognized IPv4-mapped IPv6 addresses only in dotted-quad form, so a hex literal such as ::ffff:7f00:1 fell through to the default "not private" answer. The WHATWG URL parser normalizes the dotted form into hex before the filter runs, which means a caller never needed to know the trick: every spelling of a mapped loopback address bypassed the check. Anyone who could supply a scrape target, or make an allowed page redirect, then reached the blocked destination through Trawl's MCP tools.

## Who is affected

Operators running Trawl 1.5.0 through 1.9.3 with the MCP interface turned on are affected, and MCP stays off unless MCP_ENABLED is set to an opt-in value. Trawl says its native /scrape API does not install this validator by default, so the report is scoped to the MCP interface. Trawl reproduced the bypass against a loopback listener it owned, and states it did not test real cloud metadata endpoints or third-party hosts.

## What to do

Update to Trawl 1.10.0, which replaces the textual IPv6 classification with numeric subnet checks using node:net.BlockList and adds connection-time public egress enforcement. Because the advisory scopes the flaw to the opt-in MCP interface, operators who cannot update yet can leave MCP_ENABLED unset.

## Quick facts

- **Affected:** Trawl 1.5.0 through 1.9.3, MCP interface only
- **Fixed in:** 1.10.0
- **CVE:** CVE-2026-122140
- **CVSS:** 6.3 (CVSS v4.0, GitHub Advisory Database)
- **Found by:** Leardian
- **Disclosed:** 3 November 2026
- **Attack type:** Server-side request forgery, CWE-918

## Sources

1. [Trawl Advisory](https://github.com/germondai/trawl/security/advisories/GHSA-mj45-84p2-v77q)
2. [GitHub Advisory DB](https://github.com/advisories/GHSA-42jx-rr99-g8v2)
3. [Fix PR 263](https://github.com/germondai/trawl/pull/263)