—
GO-2026-5446
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer in github.com/axllent/mailpit
Quick fix
GO-2026-5446 — github.com/axllent/mailpit: upgrade to the fixed version with the command below.
go get github.com/axllent/mailpit@v1.30.0Details
Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filter dialer in github.com/axllent/mailpit
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/axllent/mailpit
Introduced in:
1.28.3Fixed in: 1.30.0Fix
go get github.com/axllent/mailpit@v1.30.0