-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| link-preview-js | npm | < 2.1.17 | 2.1.17 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient DNS rebinding protection. The throwOnLoopback function in vulnerable versions only performed simple string matching against 'localhost' and '127.0.0.1', rather than comprehensive private IP range checks. This allowed bypasses via alternative loopback addresses (like 0.0.0.0) or private network IPs. The getLinkPreview function is inherently vulnerable as it initiates requests without adequate IP validation. The GitHub PR #117 confirms these points by showing the addition of regex-based IP validation in throwOnLoopback to fix the SSRF flaw.