THREAT OPS › Threat News › [GHSA] GHSA-q8hw-4fvp-9rwv (medium) — Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
[GHSA] GHSA-q8hw-4fvp-9rwv (medium) — Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
GHSA-q8hw-4fvp-9rwv Severity: medium CVE: CVE-2026-61793
Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter
### Summary `nuxt-og-image` exposes an **unauthenticated HTTP endpoint** at `/_og/d/**` that base64url-decodes and `JSON.parse`s a `fonts` URL segment, then passes each `fonts[i].path` value directly into `fetch()` server-side **without any URL validation** (no scheme
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-61793cve
- http://target/url
- http://127.0.0.1:3000url
- http://127.0.0.1:3000/_og/d/${seg}.png`url
- http://127.0.0.1:9000/PWN?via=og-imageurl
- http://169.254.169.254/latest/meta-data/iam/security-credentials/url
- http://127.0.0.1:22/url
- http://kubernetes.default.svc.cluster.local/api/...`url
- 127.0.0.0/8cidr
- 10.0.0.0/8cidr
- 172.16.0.0/12cidr
- 192.168.0.0/16cidr
- 169.254.0.0/16cidr
Original source: https://github.com/advisories/GHSA-q8hw-4fvp-9rwv