Vulnerability-Lookup vulnerabilities

SSRF vulnerability in the remote-instance synchronization functionality of Vulnerability-Lookup. Remote instance addresses were validated only for basic URL syntax before being stored, and the synchronization worker later dereferenced them without network-boundary restrictions, following redirects without revalidation. An authenticated administrator with admin:access permission could configure a remote instance pointing to internal, loopback, link-local, or cloud metadata services.

Vulnerability-Lookup has an authentication weakness in account activation and password recovery, where tokens are reusable and not purpose-bound. An attacker who obtains a valid link can repeatedly change the password and take control of the account.

An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator only checked the X-API-KEY header against an existing user API key, without verifying the account's is_active and is_confirmed state. An attacker could create an account and immediately use the API key to access Pub/Sub topics that should only be available to active, confirmed users.

A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpolated into HTML badge elements and wrapped in markupsafe.Markup, bypassing Jinja's automatic HTML escaping. An authenticated user with permissions to create or modify vulnerability records could submit a crafted reference tag through the CNA API containing arbitrary HTML or JavaScript-capable markup.