{"id":"GHSA-pqhr-mp3f-hrpp","aliases":[],"url":"https://o3.security/vulnerability/GHSA-pqhr-mp3f-hrpp","summary":"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters","details":"**Product:** Nuxt OG Image\n**Version:** < 6.2.5\n**CWE-ID:** [CWE-918](https://cwe.mitre.org/data/definitions/918.html): Server-Side Request Forgery\n\n## Description\n\nThe image generation endpoint (`/_og/d/`) accepts user-controlled parameters that are passed to the server-side renderer without proper validation or filtering. An attacker can trigger server-side requests to internal network addresses through multiple vectors.\n\n## Impact\n\n- Scanning internal ports and services inaccessible from the outside\n- Reading sensitive data from cloud infrastructure metadata services (tokens, credentials) when verbose error output is enabled\n\n## Attack Vectors\n\nThree distinct vectors were identified, all exploiting the same underlying lack of URL validation:\n\n### Vector 1: CSS `background-image` injection via `style` parameter\n\n```\nGET /_og/d/og.png?style=background-image:+url('http://127.0.0.1:8888/secret')\n```\n\n### Vector 2: `<img src>` injection via `html` parameter\n\n```\nGET /_og/d/og.png?html=<img src=\"http://127.0.0.1:8888/secret\">\n```\n\nWhen verbose errors are enabled, the response content is leaked in base64-encoded error messages.\n\n### Vector 3: SVG `<image href>` injection via `html` parameter\n\n```\nGET /_og/d/og.png?html=<svg><image href=\"http://127.0.0.1:8888/secret\"></svg>\n```\n\n## Mitigation\n\nFixed in v6.2.5. The image source plugin now blocks requests to private IP ranges (IPv4/IPv6), loopback addresses, link-local addresses, and cloud metadata endpoints. Decimal/hexadecimal IP encoding bypasses are also handled.\n\n## Credits\n\nResearcher: Dmitry Prokhorov (Positive Technologies)","published":"2026-03-31T23:26:29Z","modified":"2026-03-31T23:34:55.380779Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"nuxt-og-image","fixedVersion":"6.2.5"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/nuxt-modules/og-image/security/advisories/GHSA-pqhr-mp3f-hrpp"},{"type":"PACKAGE","url":"https://github.com/nuxt-modules/og-image"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-31T23:34:55.380779Z"}}