Executive brief
Nuxt OG Image is a Vue template system for generating social media preview images in Nuxt applications. The image generation endpoint fails to validate user-supplied parameters, allowing attackers to make requests to internal network services and cloud metadata endpoints without authentication. This could expose sensitive credentials or reveal internal network configuration to an attacker.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the /_og/d/ image generation endpoint. The endpoint accepts user-controlled parameters (style, html) without proper validation before passing them to the server-side renderer. Attackers can inject CSS background-image URLs, img src attributes, or SVG image hrefs pointing to internal addresses (127.0.0.1, private ranges, cloud metadata endpoints) to trigger server-side requests. No authentication or user interaction is required; the attack is triggered via simple GET requests. An attacker can scan internal services, read metadata credentials when verbose errors are enabled, and leak response content via base64-encoded error messages. The vulnerability is fixed in version 6.2.5 by blocking requests to private IP ranges, loopback addresses, link-local addresses, and cloud metadata endpoints, including protection against decimal/hexadecimal IP encoding bypasses.
Affected products
- Nuxt OG Image < 6.2.5
Timeline
- 2026-03-31: disclosed
- 2026-03-31: patched: Fixed in version 6.2.5