{"answers":{"affected":"2 open source packages ship an affected version, including nuxt-og-image.","exploited":"There is no known exploitation of GHSA-pqhr-mp3f-hrpp in the wild and no public exploit code.","fix":"Upgrade nuxt-og-image to 6.2.5 or later.","what":"GHSA-pqhr-mp3f-hrpp is a server-side request forgery vulnerability in nuxt-og-image, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-pqhr-mp3f-hrpp and fix it if it is affected.\n\nWhat it is: GHSA-pqhr-mp3f-hrpp is a server-side request forgery vulnerability in nuxt-og-image, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-pqhr-mp3f-hrpp in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- nuxt-og-image (npm): affected all versions; fixed in 6.2.5\n- nuxt-og-image (npm): affected all versions; fixed in 6.2.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/ (Markdown: https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/index.md)","id":"GHSA-pqhr-mp3f-hrpp","markdown":"https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/index.md","name":"GHSA-pqhr-mp3f-hrpp","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Nuxt OG Image","requires_auth":"none","summary":"Attackers can exploit SSRF in Nuxt OG Image to scan internal networks and read sensitive cloud metadata via unvalidated user parameters.","user_interaction":"not_required","vuln_class":"ssrf"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"**Product:** Nuxt OG Image\n**Version:** \u003c 6.2.5\n**CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery\n\n## Description\n\nThe image generation endpoint (`/_og/d/`) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors.\n\n## Impact\n\n- Scanning internal ports and services inaccessible from the outside\n- Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) when verbose error output is enabled\n\n## Attack Vectors\n\nThree distinct vectors were identified, all exploiting the same underlying lack of URL validation:\n\n### Vector 1: CSS `background-image` injection via `style` parameter\n\n```\nGET /_og/d/og.png?style=background-image:+url('http://127.0.0.1:8888/secret')\n```\n\n### Vector 2: `\u003cimg src\u003e` injection via `html` parameter\n\n```\nGET /_og/d/og.png?html=\u003cimg src=\"http://127.0.0.1:8888/secret\"\u003e\n```\n\nWhen verbose errors are enabled, the response content is leaked in base64-encoded error messages.\n\n### Vector 3: SVG `\u003cimage href\u003e` injection via `html` parameter\n\n```\nGET /_og/d/og.png?html=\u003csvg\u003e\u003cimage href=\"http://127.0.0.1:8888/secret\"\u003e\u003c/svg\u003e\n```\n\n## Mitigation\n\nFixed in v6.2.5. The image source plugin now blocks requests to private IP ranges (IPv4/IPv6), loopback addresses, link-local addresses, and cloud metadata endpoints. Decimal/hexadecimal IP encoding bypasses are also handled.\n\n## Credits\n\nResearcher: Dmitry Prokhorov (Positive Technologies)","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters","id":"GHSA-pqhr-mp3f-hrpp","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"ssrf","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["6.2.5"],"introduced":["0"],"last_affected":[],"package":"nuxt-og-image","purl":null,"source":"GHSA-pqhr-mp3f-hrpp"},{"ecosystem":"npm","fixed":["6.2.5"],"introduced":["0"],"last_affected":[],"package":"nuxt-og-image","purl":"pkg:npm/nuxt-og-image","source":"GHSA-pqhr-mp3f-hrpp"}],"products":null,"published":"2026-03-31","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can exploit SSRF in Nuxt OG Image to scan internal networks and read sensitive cloud metadata via unvalidated user parameters.","url":"https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/"}