Description
The package link-preview-js before 2.1.17 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
Recommendation
Update the link-preview-js package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.1.17
- Patched version(s): 2.1.17
References
Could your website be exposed too?
SmartScanner can check your website for Server-Side Request Forgery in link-preview-js and gives you actionable findings to investigate.
Start a free scanRelated Issues
- uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - uppy - CVE-2022-0086
- Server-Side Request Forgery in @peertube/embed-api - CVE-2022-0508
- Server-Side Request Forgery in parse-url - CVE-2022-2216
- uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) - CVE-2022-0086
You might also like:
See something that needs correcting? Let us knowUpdated January 27, 2023