CVE-2026-67201: v 0 through 0.5.2

Affected technology

v · 0 through 0.5.2
vlang

Description’s affected range: through 0.5.2, fixed in commit 85859f0,

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block. Vendor/CNA’s CVSS 4.0 assessment (base score 7.7/10) rates confidentiality, integrity and availability impact as none.