GHSA-c6xh-wv4j-ppv5: Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Flowise has a critical security flaw in its SSRF (server-side request forgery, a vulnerability where an attacker tricks a server into making requests to unintended targets) protection that fails to properly check IPv4-mapped IPv6 addresses (a format like ::ffff:127.0.0.1 that disguises IPv4 addresses as IPv6). Because the code compares address types without converting them to a common format, attackers who control DNS records can bypass all IP-based access restrictions and reach internal services or cloud metadata endpoints.