CVE-2025-8020

View on CVE.org
Published Jul 23, 2025 CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Description
All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-22416 private-ip vulnerable to Server-Side Request Forgery
Github GHSA Github GHSA GHSA-9h3q-32c7-r533 private-ip vulnerable to Server-Side Request Forgery
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP address (224.0.0.0/4) which is not included as part of the private IP ranges in the package's source code.
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
snyk
Published
Updated
Aug 22, 2026, 4:12 PM
Reserved
Jul 22, 2025, 7:52 AM

View source JSON

Updated
Jul 23, 2025, 2:24 PM

JSON

Status
Deferred
Published
Jul 23, 2025, 5:15 AM
Modified
Jun 17, 2026, 10:06 AM

View source JSON

No data.

No data.