Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-42181 Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkP… https://www.cve.org/CVERecord?id=CVE-2026-42181
Post summary
CVE-2026-42181 involves Lemmy's handling of metadata for user URLs and is fixed in version 0.19.18; no PoC, exploit, or active attack information is present.
CVE-2026-42181 Server-Side Request Forgery in Lemmy Prior to Version 0.19.18 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42181
Post summary
A brief disclosure of a Server‑Side Request Forgery vulnerability (CVE‑2026‑42181) affecting Lemmy before 0.19.18, with no PoC, exploit tools, or patches mentioned.