CVE-2022-25876: Server-Side Request Forgery (SSRF)

July 1, 2022 (updated July 12, 2022)

The package link-preview-js before 2.1.16 is vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.

References

github.com/ospfranco/link-preview-js/issues/115
github.com/ospfranco/link-preview-js/pull/117
nvd.nist.gov/vuln/detail/CVE-2022-25876
snyk.io/vuln/SNYK-JS-LINKPREVIEWJS-2933520

Code Behaviors & Features

Detect and mitigate CVE-2022-25876 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →