slab vulnerabilities

Products

• safeurl 2
• quill 1

Latest slab CVEs

Newest publication first

1. CVE-2026-77866 SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

   Published 2026-09-15

   Critical·CVSS 9.0 EPSS 0.48%

   Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other a...

2. CVE-2026-77972 safeurl validated address is not bound to the request, allowing DNS rebinding

   Published 2026-09-15

   Critical·CVSS 9.0 EPSS 0.33%

   Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the libr...

3. CVE-2025-15056 Quill 2.0.3 - Lack of data validation in HTML export allowing XSS

   Published 2026-01-13

   Medium·CVSS 5.1 EPSS 0.27%

   A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.