Summary
Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images
Workarounds
No workaround is known, the package should be upgraded.
For more information
If you have any questions or comments about this advisory, open an issue in ZMarkdown.
Impact
A major blind SSRF has been found in remark-images-download, which allowed
for requests to be made to neighboring servers on local IP ranges.
The issue came from a loose filtering of URLs inside the module.
Imagine a server running on a private network 192.168.1.0/24.
A private service serving images is running on 192.168.1.2, and
is not expected to be accessed by users. A machine is runningremark-images-download on the neighboring 192.168.1.3 host.
An user enters the following Markdown:
The image is downloaded by the server and included inside the resulting
document. Hence, the user has access to the private image.
It has been corrected by preventing images downloads from
local IP ranges, both in IPv4 and IPv6.
To avoid malicious domain names, resolved local IPs from are also
forbidden inside the module.
This vulnerability impact is moderate, as it is can allow access to
unexposed documents on the local network, and is very easy
to exploit.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The vulnerability has been patched in version 3.1.0.
If impacted, you should update to this version as soon as possible.
Please note that a minor version has been released instead of a bugfix.
This is due to a new option included to prevent another vulnerability,
upgrading to the new version will not break compatibility.
Frequently Asked Questions
- What is GHSA-MF74-QQ7W-6J7V? GHSA-MF74-QQ7W-6J7V is a medium-severity security vulnerability in remark-images-download (npm), affecting versions < 3.1.0. It is fixed in 3.1.0.
- Which versions of remark-images-download are affected by GHSA-MF74-QQ7W-6J7V? remark-images-download (npm) versions < 3.1.0 is affected.
- Is there a fix for GHSA-MF74-QQ7W-6J7V? Yes. GHSA-MF74-QQ7W-6J7V is fixed in 3.1.0. Upgrade to this version or later.
- Is GHSA-MF74-QQ7W-6J7V exploitable, and should I be worried? Whether GHSA-MF74-QQ7W-6J7V is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-MF74-QQ7W-6J7V is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-MF74-QQ7W-6J7V? Upgrade
remark-images-downloadto 3.1.0 or later.