CVE-2022-25876
MEDIUMlink-preview-js < 2.1.16 - Server-Side Request Forgery via DNS Rebinding Bypass
Title source: llmDescription
The package link-preview-js before 2.1.16 are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
References (3)
Core 3
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/ospfranco/link-preview-js/issues/115
Exploit, Third Party Advisory x_refsource_misc
https://snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-2933520
Patch, Third Party Advisory x_refsource_misc
https://github.com/ospfranco/link-preview-js/pull/117
Scores
CVSS v3
6.2
EPSS
0.0007
EPSS Percentile
22.3%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (2)
link-preview-js_project/link-preview-js
< 2.1.16
npm/link-preview-js
0 - 2.1.17npm
Published
Jul 01, 2022
Tracked Since
Feb 18, 2026