CVE-2026-55526 (GHSA-X44H-65QV-CW74)

@@ -30,0 +55,18 @@+            if hostname in ['localhost', '127.0.0.1', '0.0.0.0', '::1']:+                return False+            +            # Block private IP ranges+            import ipaddress+            try:+                ip = ipaddress.ip_address(hostname)+                if ip.is_private or ip.is_reserved or ip.is_loopback or ip.is_link_local:+                    return False+            except ValueError:

+                # Not an IP address, continue with domain validation+                pass+            +            # Block common internal domains+            if any(hostname.endswith(domain) for domain in ['.local', '.internal', '.localdomain']):+                return False+            +            # Block metadata service endpoints

@@ -58,11 +58,13 @@         pass      try:-        return _ip_blocked(ipaddress.ip_address(socket.inet_aton(host)))-    except OSError:-        pass+        for info in socket.getaddrinfo(host, None):+            if _ip_blocked(ipaddress.ip_address(info[4][0])):+                return True+    except socket.gaierror:

+        return True      return False  class SpiderTools:     """Tools for web scraping and crawling."""