{"action":"Upgrade lemmy_api_common to 0.19.18 or later.","affected":[{"fixed":"0.19.18","introduced":"0"}],"component":"lemmy_api_common","cve_ids":["CVE-2026-42181"],"ecosystem":"crates.io","epss":0.00354,"exploited":false,"fixed_versions":["0.19.18"],"ghsa_id":"GHSA-h6hf-9846-xwrq","id":"tcs_01M5KF0CKXQ29DBBQHHMFC0EE9","modified_at":"2026-05-13T13:52:25.356705Z","published_at":"2026-04-24T15:21:58Z","references":["https://osv.dev/vulnerability/GHSA-h6hf-9846-xwrq","https://github.com/LemmyNet/lemmy/security/advisories/GHSA-h6hf-9846-xwrq","https://nvd.nist.gov/vuln/detail/CVE-2026-42181","https://github.com/LemmyNet/lemmy/commit/9ffe586dafac1a46acf17edf90e0165e5503b2f1","https://github.com/LemmyNet/lemmy","https://github.com/LemmyNet/lemmy/releases/tag/0.19.18","https://join-lemmy.org/news/2026-04-20_-_Lemmy_Release_v0.19.18"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-h6hf-9846-xwrq","url":"https://osv.dev/vulnerability/GHSA-h6hf-9846-xwrq"}],"summary":"Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image"}