The SSRF Fix Cursor Writes Is Still Vulnerable (CWE-918)

TL;DR

Ask an AI editor to fix an SSRF and it writes a DNS lookup, an IP range check, then fetch(url). That check does not hold.

Node resolves the hostname a second time when it opens the socket, so an attacker's nameserver can return a public IP for your check and 169.254.169.254 for the actual connection.

Validate inside the connection, not before it. Then turn on IMDSv2 and egress rules so the application code is not the only thing standing between a URL parameter and your credentials.

I asked Cursor to fix an SSRF last week. It found the bug immediately, explained CWE-918 correctly, and rewrote the endpoint with a URL parser, a DNS resolution, a private-range check and redirects disabled. It looked like something out of a security guide. I nearly approved it.