AIKIDO-2026-10535

TL;DR

Affected versions of this package are vulnerable to an improper network permission bypass where deny rules could be evaded by using alternative representations of the same IP address, such as IPv4-mapped IPv6 addresses or numeric hostname aliases that resolve to denied addresses. This may allow restricted connections to hosts like localhost or denied subnets despite explicit deny-net rules. An attacker might exploit this by supplying a blocked target in decimal, hexadecimal, or IPv4-mapped IPv6 form (for example, 2130706433, 0x7f000001, or ::ffff:127.0.0.1) to reach internal services, localhost-only ports, or other protected network resources that should have been denied.