Proof of concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
29 Jun 2022
22 Jun 2022
How to fix?
link-preview-js to version 2.1.16 or higher.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) which allows attackers to send arbitrary requests to the local network and read the response. This is due to flawed DNS rebinding protection.
Find domain that resolved to private address with reverse ip lookup or use domains localtest.me (127.0.0.1) or devhead.net (127.0.0.1 + 192.168.1.1 + 192.168.0.1).
Write it to
You see content from your local address.