Headline

GHSA-h9cw-7g8j-h66h: Server-Side Request Forgery in link-preview-js

The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

2 years ago

ghsa

Open in Source

#js #git #ssrf

Server-Side Request Forgery in link-preview-js

Moderate severity GitHub Reviewed Published Jul 2, 2022 • Updated Jul 6, 2022

The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

2 years ago

CVE

Open in Source