Dub
Monthly
Server-side request forgery in Dub's metatags edge endpoint allows unauthenticated remote attackers to direct the server to issue HTTP requests to arbitrary internal or external hosts. All Dub versions through 2026-07-10 are affected, with the root cause being the endpoint's acceptance of caller-supplied URLs without any denylist filtering or authentication requirement. Attackers can leverage this to probe RFC 1918 address space, enumerate internal services, or exfiltrate credentials from cloud metadata endpoints such as AWS IMDSv1; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Open redirect in Dub's link management platform allows unauthenticated network attackers to append a redir_url query parameter to any existing short link, redirecting visitors through the trusted Dub domain to arbitrary external URLs without validation or allowlist enforcement. All versions up to commit 73415cf5e6be13ce9adb7ba5e97474307db34a17 are affected, with the flaw residing in the get-final-url.ts middleware. The primary risk is phishing amplification: attackers can weaponize Dub's brand reputation and link-cloaking feature to deliver convincing lure URLs that bypass corporate URL reputation filters which trust the Dub domain.
Server-side request forgery in Dub's metatags edge endpoint allows unauthenticated remote attackers to direct the server to issue HTTP requests to arbitrary internal or external hosts. All Dub versions through 2026-07-10 are affected, with the root cause being the endpoint's acceptance of caller-supplied URLs without any denylist filtering or authentication requirement. Attackers can leverage this to probe RFC 1918 address space, enumerate internal services, or exfiltrate credentials from cloud metadata endpoints such as AWS IMDSv1; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Open redirect in Dub's link management platform allows unauthenticated network attackers to append a redir_url query parameter to any existing short link, redirecting visitors through the trusted Dub domain to arbitrary external URLs without validation or allowlist enforcement. All versions up to commit 73415cf5e6be13ce9adb7ba5e97474307db34a17 are affected, with the flaw residing in the get-final-url.ts middleware. The primary risk is phishing amplification: attackers can weaponize Dub's brand reputation and link-cloaking feature to deliver convincing lure URLs that bypass corporate URL reputation filters which trust the Dub domain.