CVE-2026-44589: falha de baixa gravidade em nuxt-modules og-image
nuxt-og-image SSRF — bypass of GHSA-pqhr-mp3f-hrpp / v6.2.5 fix (IPv6 + redirect)
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.2%
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies, March 2026) is incomplete. It has an incomplete IPv6 prefix list and is missing redirect re-validation. This vulnerability is fixed in 6.4.9.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
nuxt-modules · og-imageCVEs relacionadas — nuxt-modules og-image
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61793MEDIUMNuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameterEPSS 0.5%CVE-2026-34404MEDIUMNuxt OG Image vulnerable to DoS via image generationEPSS 0.3%CVE-2026-34405MEDIUMNuxt OG Image vulnerable to reflected XSS via query parameter injection into HTML attributesEPSS 0.2%CVE-2026-102527MEDIUMNuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesEPSS 0.2%