GHSA-m2mm-7xvw-9623

Budibase routes outbound HTTP(S) requests (automation steps such as Outgoing Webhook, Zapier, n8n, Slack, Discord, plus the REST datasource, OAuth2 token fetch, query import and object-store import) through a shared allow/deny guard, fetchWithBlacklist, which rejects a target when its resolved address matches a hardcoded default deny list. That deny list blocks the IPv6 loopback address ::1/128 but omits the IPv6 unspecified address :: (::/128). Because the operating system routes an outbound connection to :: onto the IPv6 loopback, an authenticated workspace Builder/Creator who supplies a URL whose host is [::] passes the guard and reaches services bound to IPv6 loopback or to a dual-stack wildcard (for example the Budibase server on port 4001 and worker on port 4002), and the response body or error is reflected back into the step or query output. This defeats the server-side request forgery control that the deny list is meant to enforce.