CVE-2026-42181
1 advisory.
crates.io/lemmy_api_common CVE-2026-42181: medium 6.5
Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image
Action: Upgrade lemmy_api_common to 0.19.18 or later.
cargo update -p lemmy_api_common --precise 0.19.18Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.19.18 | - |
Fixed versions
| 0.19.18 |
Sources
- osv: GHSA-h6hf-9846-xwrq
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq
- https://nvd.nist.gov/vuln/detail/CVE-2026-42181
- https://github.com/LemmyNet/lemmy/commit/9ffe586dafac1a46acf17edf90e0165e5503b2f1
- https://github.com/LemmyNet/lemmy
- https://github.com/LemmyNet/lemmy/releases/tag/0.19.18
- https://join-lemmy.org/news/2026-04-20_-_Lemmy_Release_v0.19.18
CVE-2026-42181 · published · modified · JSON