CVE-2026-61704

{"id": "CVE-2026-61704", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61704", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:03:06.178339Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OP-Engineering", "product": "link-preview-js", "versions": [{"status": "affected", "version": "< 4.0.4"}]}]}], "published": "2026-08-20T17:18:51.940", "references": [{"url": "https://github.com/OP-Engineering/link-preview-js/commit/6ee25043dd60b097eb70b4ce049aac94b28239e3", "source": "security-advisories@github.com"}, {"url": "https://github.com/OP-Engineering/link-preview-js/commit/f3a3dd84adbb9d32d06a933f44ff3eaa837f9a12", "source": "security-advisories@github.com"}, {"url": "https://github.com/OP-Engineering/link-preview-js/pull/181", "source": "security-advisories@github.com"}, {"url": "https://github.com/OP-Engineering/link-preview-js/releases/tag/4.0.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/OP-Engineering/link-preview-js/security/advisories/GHSA-cpjf-6666-r8fx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Link Preview JS extracts web links information. Prior to 4.0.4, the resolveDNSHost mitigation in index.ts validates one resolved IP address but fetches the original hostname, allowing an attacker-controlled DNS server to return a public address during validation and a loopback or internal address during the final connection. This DNS rebinding condition bypasses the SSRF protection and can cause the server-side preview fetch to reach internal HTTP resources. Redirect handling is affected by the same validation-to-fetch mismatch. This issue is fixed in version 4.0.4."}, {"lang": "es", "value": "Link Preview JS extrae informaci\u00f3n de enlaces web. Antes de la versi\u00f3n 4.0.4, la mitigaci\u00f3n resolveDNSHost en index.ts valida una direcci\u00f3n IP resuelta pero obtiene el nombre de host original, permitiendo que un servidor DNS controlado por un atacante devuelva una direcci\u00f3n p\u00fablica durante la validaci\u00f3n y una direcci\u00f3n de bucle invertido o interna durante la conexi\u00f3n final. Esta condici\u00f3n de revinculaci\u00f3n de DNS elude la protecci\u00f3n SSRF y puede hacer que la obtenci\u00f3n de la vista previa del lado del servidor alcance recursos HTTP internos. El manejo de redirecciones se ve afectado por la misma falta de coincidencia entre validaci\u00f3n y obtenci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 4.0.4."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}