gomarkdown/markdown IsSafeURL panics on short URLs

Summary IsSafeURL slices url:nPath before checking that lenurl = nPath, so a URL shorter than a path prefix 0, 1 or 2 bytes triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination...

Instatic-Stored-XSS-CVE-2026-103931

URL scheme filter bypass in isSafeUrl via leading C0 control characters Affected: Instatic v0.0.13 / commit 63ad5d6 and all earlier revisions containing src/core/html-sanitize/index.ts Component: src/core/html-sanitize/index.ts → isSafeUrl / safeUrl Class: CWE-79 Stored XSS via CWE-184 Incomplete...

CVE-2026-80347

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-54494

Koel is a free, open-source music streaming solution. Prior to 9.7.1, App\Helpers\Network::isPublicHost uses filtervar with FILTERFLAGNOPRIVRANGE and FILTERFLAGNORESRANGE, which treats NAT64 64:ff9b::/96 and 6to4 2002::/16 wrappers of private, loopback, or link-local IPv4 addresses as public. An...