Trawl: a hex IPv6 address sends its MCP scraper to loopback

01What happened

Trawl, a self-hosted web scraper for applications and AI agents, published advisory GHSA-mj45-84p2-v77q on 3 November 2026 for a server-side request forgery flaw in its optional MCP interface. Leardian reported the issue and is credited on the advisory, and the fix shipped in version 1.10.0. The GitHub Advisory Database assigned CVE-2026-122140 the following day.

02How it works

Trawl's outbound URL policy recognized IPv4-mapped IPv6 addresses only in dotted-quad form, so a hex literal such as ::ffff:7f00:1 fell through to the default "not private" answer. The WHATWG URL parser normalizes the dotted form into hex before the filter runs, which means a caller never needed to know the trick: every spelling of a mapped loopback address bypassed the check. Anyone who could supply a scrape target, or make an allowed page redirect, then reached the blocked destination through Trawl's MCP tools.

03Who is affected

Operators running Trawl 1.5.0 through 1.9.3 with the MCP interface turned on are affected, and MCP stays off unless MCP_ENABLED is set to an opt-in value. Trawl says its native /scrape API does not install this validator by default, so the report is scoped to the MCP interface. Trawl reproduced the bypass against a loopback listener it owned, and states it did not test real cloud metadata endpoints or third-party hosts.

04What to do

Update to Trawl 1.10.0, which replaces the textual IPv6 classification with numeric subnet checks using node:net.BlockList and adds connection-time public egress enforcement. Because the advisory scopes the flaw to the opt-in MCP interface, operators who cannot update yet can leave MCP_ENABLED unset.

Sources 3 links, all fetched

1. 1github.comTrawl Advisory
2. 2github.comGitHub Advisory DB
3. 3github.comFix PR 263