# GHSA-pqhr-mp3f-hrpp: Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters

> Attackers can exploit SSRF in Nuxt OG Image to scan internal networks and read sensitive cloud metadata via unvalidated user parameters.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 31 Mar 2026

## What is GHSA-pqhr-mp3f-hrpp?

GHSA-pqhr-mp3f-hrpp is a server-side request forgery vulnerability in nuxt-og-image, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

**Product:** Nuxt OG Image
**Version:** < 6.2.5
**CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery

## Description

The image generation endpoint (`/_og/d/`) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors.

## Impact

- Scanning internal ports and services inaccessible from the outside
- Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) when verbose error output is enabled

## Attack Vectors

Three distinct vectors were identified, all exploiting the same underlying lack of URL validation:

### Vector 1: CSS `background-image` injection via `style` parameter

```
GET /_og/d/og.png?style=background-image:+url('http://127.0.0.1:8888/secret')
```

### Vector 2: `<img src>` injection via `html` parameter

```
GET /_og/d/og.png?html=<img src="http://127.0.0.1:8888/secret">
```

When verbose errors are enabled, the response content is leaked in base64-encoded error messages.

### Vector 3: SVG `<image href>` injection via `html` parameter

```
GET /_og/d/og.png?html=<svg><image href="http://127.0.0.1:8888/secret"></svg>
```

## Mitigation

Fixed in v6.2.5. The image source plugin now blocks requests to private IP ranges (IPv4/IPv6), loopback addresses, link-local addresses, and cloud metadata endpoints. Decimal/hexadecimal IP encoding bypasses are also handled.

## Credits

Researcher: Dmitry Prokhorov (Positive Technologies)

## Which versions are affected by GHSA-pqhr-mp3f-hrpp?

2 open source packages ship an affected version, including nuxt-og-image.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `nuxt-og-image` | npm | All versions | 6.2.5 |
| `nuxt-og-image` | npm | All versions | 6.2.5 |

## How do I fix GHSA-pqhr-mp3f-hrpp?

Upgrade nuxt-og-image to 6.2.5 or later.

## Is GHSA-pqhr-mp3f-hrpp being exploited?

There is no known exploitation of GHSA-pqhr-mp3f-hrpp in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-pqhr-mp3f-hrpp and fix it if it is affected.

What it is: GHSA-pqhr-mp3f-hrpp is a server-side request forgery vulnerability in nuxt-og-image, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-pqhr-mp3f-hrpp in the wild and no public exploit code.

Affected packages and fixed versions:
- nuxt-og-image (npm): affected all versions; fixed in 6.2.5
- nuxt-og-image (npm): affected all versions; fixed in 6.2.5

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/ (Markdown: https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-pqhr-mp3f-hrpp

---
From sbomify Insights: https://insights.sbomify.com/GHSA-pqhr-mp3f-hrpp/
Summaries are generated and may contain mistakes; the official description above is the record.