GitHub Advisoryadvisory · npm

GHSA-h9cw-7g8j-h66h Server-Side Request Forgery in link-preview-js

MEDIUM Published 2022-07-02 Modified 2022-07-13 Official page ↗
Aliases
CVE-2022-25876
Ecosystem
npm
Packages
link-preview-js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2022-07-06

Affected packages

• npm link-preview-js: < 2.1.17 → fixed in 2.1.17

Description

The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

Related

Alias · CVE (1)

  • CVE-2022-25876 The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References