Link Preview JS extracts metadata from URLs. Prior to version 4.0.1 the library did not validate or restrict IPv6 loopback or DNS resolutions that could target internal IP addresses. A malicious URL supplied to the library could therefore cause it to contact internal network resources, causing the application to expose or download internal data. The vulnerability enables an attacker to obtain data that should otherwise remain private, compromising confidentiality.

The affected product is OP‑Engineering’s link‑preview‑js library. All releases before 4.0.1 are vulnerable; patching to 4.0.1 or later removes the flaw.

The CVSS score of 8.7 represents high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation. Nonetheless, the likely attack vector is when an application processes a user‑supplied URL; the attacker constructs a link that resolves to an internal address, and the library inadvertently contacts that address, leaking data. The risk remains significant for systems that expose the library to untrusted input or that have sensitive internal resources accessible via network calls.